> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/administration/user-and-group-management/passwords-and-rsa-keys.md).

# Passwords and RSA Keys

Learn about authentication in Couchdrop

## Overview

Couchdrop supports password authentication and SSH public key authentication.

Passwords can be used to sign in to the Couchdrop Web Portal and for supported file transfer protocols. SSH keys are used for **SFTP** and **SCP** authentication.

{% hint style="info" %}
**Two-factor authentication (2FA/MFA)** applies to Couchdrop web access only. It does not apply to SFTP, SCP, FTP, or other file transfer protocol connections.

For more information, see **Two-Factor Authentication (2FA/MFA)**.
{% endhint %}

### Password authentication

Password authentication is available for Couchdrop users and can be used for both web access and supported file transfer connections.

Passwords can be changed by an administrator or by the user when they have access to the Couchdrop Web Portal.

All users require a password, including users who also authenticate to SFTP or SCP using a public key.

### SSH public key authentication

Couchdrop supports SSH public key authentication for **SFTP** and **SCP**.

Public key authentication uses a key pair:

* The **public key** is added to Couchdrop.
* The **private key** remains with the user or system connecting to Couchdrop.

{% hint style="danger" %}
Never provide Couchdrop with the private key.
{% endhint %}

Public keys are configured against individual users and can be used instead of, or together with, password authentication for SFTP and SCP.

#### Supported key types

Couchdrop supports the following SSH public key types:

| Key type  | Description                                      |
| --------- | ------------------------------------------------ |
| **RSA**   | Commonly used SSH public key format.             |
| **DSA**   | Older SSH public key format.                     |
| **ECDSA** | Elliptic Curve Digital Signature Algorithm keys. |

## Generating an SSH key pair

SSH key pairs are generated outside Couchdrop. This ensures Couchdrop does not generate or hold your private key.

On macOS, Linux, or another Unix-based system, run:

```bash
ssh-keygen
```

Follow the prompts to select where the key should be stored and whether the private key should use a passphrase.

For example:

```bash
#> ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/.ssh/id_rsa): abc    
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in abc
Your public key has been saved in abc.pub
The key fingerprint is:
SHA256:slEtu8kkv6OwfhQSu0FDicYxfixekXAqXSZicPNlAJ0 user@example.com
The key's randomart image is:
+---[RSA 3072]----+
|+oOBB=o          |
|.=+@E+   .       |
|..=.=+  o .      |
| o ++ .. o       |
|  .  ++.S        |
|    . .O o       |
|    ... =        |
|     o. ..       |
|   .o.....       |
+----[SHA256]-----+

```

This creates two files:

* `abc` — your private key
* `abc.pub` — your public key

The `.pub` file is the key you add to Couchdrop.

A public key will look similar to:

```bash
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB... user@example.com
```

{% hint style="warning" %}
Never share your private key. Only the public key should be added to Couchdrop or shared with another service.
{% endhint %}

## Adding a public key to a user

To configure public key authentication:

1. Open the user in Couchdrop.
2. Navigate to **RSA Public Keys**.
3. Paste the user's public key into the available field.
4. Add the key.

A user can have multiple public keys associated with their account.

## Requiring a password and public key

For SFTP and SCP connections, Couchdrop can require both password and public key authentication.

Enable **Require Password and Public Key** for the user to require both authentication methods before access is granted.