SSH keys and host keys

MorphGate keeps your SSH keys in the encrypted vault, and checks every server's host key before it signs in.

Your SSH keys

Generate a key

  1. Choose New key next to Keys in the sidebar.
  2. Leave Generate selected, give the key a label, and choose Generate key.

MorphGate creates a new Ed25519 key. The private key is stored only in your encrypted vault.

Import a key

  1. Choose New key, then Import.
  2. Choose From file and enter the path (for example ~/.ssh/id_ed25519), or Paste the private key.
  3. If the key is encrypted, enter its passphrase. It is saved in the vault with the key.
  4. Choose Import key.

The key is copied into the vault. The original file is not changed.

Use a key

Open a key in the sidebar to see its type, fingerprint and public key. Choose Copy public key and add it to ~/.ssh/authorized_keys on your servers. Then pick the key in a host's editor under SSH key, or in an identity. A host can only use keys from its own vault.

To delete a key, open it and choose Delete, then Really delete?.

SSH agent

Instead of a key from the vault, a host can sign in with SSH agent: MorphGate offers the identities loaded in the agent at $SSH_AUTH_SOCK. This works on Linux and macOS, not yet on Windows.

Host keys

A host key proves you reached the server you meant to, and not someone in between. MorphGate trusts a host key on first use and pins it.

The first connection

When a host has not been seen before, MorphGate shows Unknown host key with the key type and fingerprint. Compare it with the fingerprint your server's admin gave you. Choose Trust and connect only if it matches. From then on the key is pinned.

With jump hosts, each hop's key is checked and pinned on its own before the next hop opens.

When a host key changes

If a host answers with a different key than the one pinned, MorphGate does not connect. It shows Host key changed with:

  • the pinned fingerprint and where it is (the file and line in known_hosts),
  • the fingerprint the host presented now,
  • what to do next.

Someone may be intercepting the connection, or the server's key was really replaced. To find out:

  1. Ask the server's admin whether the host key was rotated, and compare the new fingerprint with theirs.
  2. Only if it matches, remove the old line from the known_hosts file named in the warning, and connect again. MorphGate then asks you to trust the new key.

Copy details copies the fingerprints and file location, to send to the admin.

Where host keys are kept

MorphGate keeps the host keys you accept in its own known_hosts file in its data folder (see Install and update). It also trusts the entries in ~/.ssh/known_hosts, read-only. A changed key in either file blocks the connection.

Host keys are kept per device and don't sync. A new device asks you to trust each host's key the first time it connects.

Where you see the pinned key

Once connected, the route bar above the session shows the pinned key's type and a short fingerprint. Hover it for the full fingerprint. The host editor's Connection path says key pinned.

Keys in a team

Keys in a team's shared vault can be used by everyone with access to that vault. When someone leaves, the app can replace a shared key on every server that uses it. Members can also publish the public keys they use on the team's servers, so they can be found and removed later. See Removing members and rotating keys.