SSH access to your hosting: add your IP address and log in with an SSH key

To get SSH access to your LJPc hosting you need two things: a static IP address and an SSH key. Send us your IP address and the public part of your key, we enable SSH for your site, and from then on you log in with your key instead of a password, over SFTP too. If your IP address changes later, you update it in the customer portal or pass it on to us.

This guide explains why SSH works this way, how to create a key on Windows, macOS and Linux, what to include in your request, how to connect and how to manage your trusted IP addresses yourself. If you only want to upload files, you do not need SSH: FTPS or your browser will do, see upload files with FTP, FTPS and SFTP and the Plesk File Manager.

Why SSH needs a static IP address and a key

SSH puts you directly on the server, with access to every file of your site. That is why our servers only accept SSH from IP addresses on the list of trusted addresses. Any other connection is closed straight away, before anyone gets the chance to try a login. Whoever does get through always logs in with an SSH key. That way nobody can guess their way into your account, not even with a leaked password.

A home connection usually gets an address that changes now and then. With such an address you are on the list one day and off it the next. Ask your provider whether you have a static IP address, or pick a VPN service that gives you a dedicated static address.

Step 1: create an SSH key

An SSH key consists of two files. The private key stays on your own computer and you never share it, not even with us. The public key, the file ending in .pub, is safe to share: that is the one we put on the server.

1. On Windows, open PowerShell or Terminal. On macOS, open Terminal; on Linux, open a terminal window.
2. Type this command and press Enter. Replace the text between the quotes with something that helps you recognise the key, such as the name of your laptop:

   ssh-keygen -t ed25519 -C "office-laptop"

3. Press Enter to save the key in the default location. On Windows that is the .ssh folder in your user folder, on macOS and Linux it is ~/.ssh.
4. Choose a passphrase and type it twice. It protects your key if someone gets hold of your computer.
5. Show your public key. On Windows in PowerShell: Get-Content $HOME\.ssh\id_ed25519.pub. On macOS and Linux: cat ~/.ssh/id_ed25519.pub. You see a single line starting with ssh-ed25519. That line goes into your request.

If ssh-keygen does not work on Windows, add the OpenSSH Client under Settings > System > Optional features. Already have an SSH key? You can use it. Our servers accept Ed25519, ECDSA and RSA keys; to create a new RSA key, run ssh-keygen -t rsa -b 4096.

Step 2: find your static IP address

Look up the IP address from the connection you will use for SSH, with your VPN switched on if you work through a VPN.

1. Open whatismyipaddress.com.
2. Write down the IPv4 address: four numbers separated by dots, such as 192.0.2.25.

Use the IPv4 address for SSH. The IPv6 address of your computer usually changes by itself, for your privacy. The difference between the two is explained in IP address blocked? How to get access again.

Step 3: request SSH access

Create a support ticket in the customer portal and include:

• the site you want SSH for, for example yourdomain.com;
• your static IPv4 address;
• your public key: the full line from the .pub file;
• which tools you need on the server, for example PHP or Git.

We enable SSH for your site, add your public key and put your IP address on the list of trusted addresses. Then we send you the server address and the username to log in with. Never send your private key; we do not need it.

Step 4: connect with SSH or SFTP

Open PowerShell or Terminal and log in with the username and server address we sent you:

ssh username@server-address

The first time, your computer asks whether you trust the server. Type yes and press Enter. It then asks for the passphrase of your key. If your key is not in the default location, point to it with -i, for example ssh -i ~/.ssh/work-key username@server-address.

If you connect often, put the details in the config file in your .ssh folder. After that, ssh mysite is all you type. The line AddressFamily inet makes sure your connection always goes over IPv4, the address on the list:

Host mysite
    HostName server-address
    User username
    IdentityFile ~/.ssh/id_ed25519
    AddressFamily inet

SFTP works with the same key and the same IP address. How to set it up in FileZilla is covered in upload files with FTP, FTPS and SFTP. Choose SFTP as the Protocol and Key file as the Logon Type.

What can you do over SSH?

You log in as the user of your own hosting subscription, in a shielded environment. You only see the files of your own subscription. Your website lives in the httpdocs folder. You have the basic commands for working with files, such as ls, cp, mv, grep, tar, zip and unzip, and you can download files with curl or wget. You can also copy files from your own computer with scp. Which other tools are available, such as PHP or Git, differs per server, so mention what you need in your request.

Manage your trusted IP addresses in the customer portal

Working from a new location, or got a new static IP address? Update the list in the customer portal. This is done with the main account; a sub-account asks the main user.

1. Log in to the customer portal. See log in to the customer portal for how that works.
2. Click your name in the top right corner (on your phone, open the menu first) and choose My account. Click the IP addresses tab.
3. Enter the new address under IP address and what it is for under Description, for example Office or VPN.
4. Click Add. You see the message IP address added successfully.

Use Edit to change an address and Remove to delete it. You add addresses one at a time. The portal sends your list to every server your websites and services run on. Remove an address as soon as you stop using it, for example when you move office or when a web developer has finished.

No IP addresses tab under My account? Send the new address in a support ticket and we add it to the list. The tab controls which addresses may reach SSH; logging in always takes your key as well.

Troubleshooting SSH

A trusted IP address can still get blocked after too many failed logins, for example by a mail app with an old password on the same network. How that protection works is explained in what is Fail2ban.

With a static IP address, an SSH key and one support ticket you have SSH and SFTP on your hosting, and you keep your list of trusted addresses up to date yourself in the customer portal. Stuck? Create a support ticket and we will look into it with you.