Signing in from your phone

Which user?

The one you enter as user@server is the account Ballast signs in as, and it sees only what that account can see. The simplest choice is the account that already runs your backups. The safer one is a separate account with read access: see Let Ballast read your backup.

Discovery reads that account's crontab, so a separate account won't find a schedule kept only in root's crontab.

Why there's a command to run

Ballast makes a key on this phone. For the server to accept it, the public half has to be in that account's ~/.ssh/authorized_keys. That's a write, and Ballast doesn't write to servers, so the command is yours to run. It's safe to run twice.

Where to run it

• On a computer: copy it, send it to yourself, then sign in to the server as that account and paste it.
• In Portholt: if you have it on this phone, Ballast shows a button to open it. Copy the command first.
• On the server's own screen: a console from your hosting provider works as well.

Signed in as a different account? Then the key lands in the wrong place and sign-in is refused. whoami tells you which one you're using.

Checking the fingerprint

The first connection shows the server's fingerprint. On the server, this should print the same thing:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub