Connecting a server via SSH

VPS Snaps connects to your servers over SSH to run database dumps and Docker backups. Your credentials are encrypted with AES-256-GCM before being stored.

What you need

• Server IP address or hostname
• SSH port (default: 22)
• SSH username (commonly root or a dedicated backup user)
• Password OR an SSH private key

Using an SSH key (recommended)

On the Add server form, choose SSH Key, then Generate a key. VPS Snaps makes an Ed25519 key just for itself and shows its public half with a one-line command to add it to the server; run that on the server (or paste the public key into your provider's console), then press Save & test connection. The private key never leaves VPS Snaps, and you can revoke it on its own later. Already have a key you want to use? Choose Add a key I have and paste the private key; keys with a passphrase can't be used, because nobody is there to type it when a backup runs. Keys live in Settings → SSH keys.

# Or make the key yourself, on your own machine
ssh-keygen -t ed25519 -N "" -C "vpssnaps-backup" -f ~/.ssh/vpssnaps_ed25519

# Copy the public key to your server
ssh-copy-id -i ~/.ssh/vpssnaps_ed25519.pub user@your-server-ip

# Then paste the private key into Add a key I have
cat ~/.ssh/vpssnaps_ed25519

Minimum SSH user permissions

If you'd rather not use root, create a dedicated backup user with just the permissions needed:

# On the server
useradd -m -s /bin/bash vpssnaps-backup

# Allow running pg_dump / mysqldump without sudo
# (or add to the postgres group for PostgreSQL)
usermod -aG postgres vpssnaps-backup

Testing the connection

After saving the server in VPS Snaps, click Test connection on the server detail page. This runs a quick SSH handshake and reports success or the specific error.

Changing a server

Open the server and click Edit to change its name, address, port, username, or how VPS Snaps signs in. A change to how it is reached is tested as soon as you save; a password is kept unless you type a new one. If the server's address points at Cloudflare's proxy (an orange cloud in Cloudflare's DNS), SSH can't get through it: use the server's own IP address, or a DNS-only name.

The server's host key

The first connection to a server pins its SSH host key, the way ssh records it in known_hosts, and shows the fingerprint on the server's page. Every later connection must present the same key. If a different one answers, the connection stops before a password is sent or a command run, and backups and restores of that server stay stopped until an owner or admin accepts the new key or keeps the old one. To check the pinned fingerprint against the server itself:

# On the server — the file matches the key type shown on the server's page
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub