Connect from your terminal using your instance’s floating IP and the private key you downloaded when you created the server. The username depends on the image; Ubuntu images typically use ubuntu, while Debian images use debian. The basic command looks like this:
ssh ubuntu@ -i /path/to/key.pem
If your key file has incorrect permissions, SSH will refuse to use it; set restrictive permissions with chmod 600 key.pem and try again. Make sure you are using the key that belongs to this specific instance; if you’ve created multiple instances, you may have multiple keys. If SSH still fails, open the web console from the instance’s detail page to verify that the instance is running and that the network is correctly configured.
The error means that the server rejected the key you provided. Confirm that you are using the correct default user for the image and that your key file has permissions set to 600. Check that the key you’re using matches the public key in ~/.ssh/authorized_keys inside the instance; if you’ve recently edited or replaced that file, your key may no longer be authorized.
If you’re locked out, use the web console to log in and restore the correct public key in the appropriate user’s authorized_keys. If the instance has been rebuilt, you must use the newer key you downloaded during the reinstallation.
Password authentication is disabled by default for security reasons. You can enable it only from within the instance or via the console, then adjust the SSH server configuration (for example, PasswordAuthentication yes) and set a strong password for the current user.
Even when password login is enabled, key-based authentication is still the recommended method because it is more resistant to brute-force attacks.
No. For security reasons, Bahnhof cannot reset or resend your private key. Access control to your instance is your responsibility. Always store key material in a secure password manager and keep an offline backup where appropriate.
ICMP (ping) is blocked by default in many firewall rules. To allow ping, select “Security Groups” in your instance’s detail view. Add an incoming ICMP rule (type 8, echo request) and an outgoing ICMP rule (type 0, echo reply).
Once the rules are saved and applied, ping <floating-ip>should start responding, unless ICMP is also blocked by a firewall inside the instance.
Access is controlled by the firewall rules in “Security Groups” on the platform and possibly by a firewall inside the guest OS. In the control panel, open the instance’s detail view, select the “Security Group” associated with the server, and create a rule for the protocol and port your service uses—for example, TCP 8080 for an HTTP interface.
Set the source to a specific CIDR range if you want to restrict access; use 0.0.0.0/0 only when the port should be accessible from the entire internet.
Om porten fortfarande är blockerad efter att du lagt till regeln, kontrollera ufw eller iptables inne i VM:en och tillåt samma port även där.
You can approximate “open” networking by adding permissive Security Group rules that let through all TCP, UDP and ICMP traffic. It is normally better to open only the ports your application needs and keep the rest closed. If you are also running a firewall in the instance, make sure its policy matches your Security Group rules to avoid confusion.
IPv6 is not yet available for VPS/VPC in this environment.
Outgoing and incoming SMTP on port 25 is normally restricted to prevent abuse. If you have a legitimate need to run email services, send a request to support and note that reverse DNS (PTR) is not offered for VPS/VPC. Forwarding email through a dedicated provider is usually a better solution.
A floating IP remains yours as long as you have it assigned to your account. You can attach and detach the IP address from instances as needed. If you delete the instance and drop the IP address, there is no guarantee that you can get the same address again, so plan moves before disconnecting an address.
You can rebuild your VPS by selecting “Rebuild VPS” in your instance detail view in the console. This also allows you to switch operating systems. Make sure you have backups or snapshots before proceeding, as a rebuild will erase and replace all data on the root disk.
The Small/Medium/Large plans cannot be resized on site. To change capacity, create a new instance of the desired size and migrate your applications or data there. If frequent resizing is a requirement, consider a custom VPC or VPS.
Use the web console to confirm that the VM is active. If you get a shell prompt, check disk space with df -h and memory usage with free -h and look for OOM events in the kernel log via dmesg.
Network problems are often caused by misconfiguration of the firewall rules in the “Security Groups” and/or the firewall rules in the OS. If the console works but the network does not, adjust the rules on both sides.
Services that do not start can normally be debugged via systemctl status <service> and logs in the journal, and a quick reboot from the control panel can clear a locked state after fixing the root problem.
For fixed VPSs, snapshots provide a snapshot of the system disk when you have backup slots available. Create a snapshot from the VPS details page when the instance is in a consistent state; temporarily stopping application services reduces the risk of data corruption. Restores can be initiated from the same view, restoring the disk to snapshot mode.
In a VPC, you can take snapshots of entire instances or individual volumes via Horizon or Skyline, making it easy to roll back experiments or clone environments. Regardless of the platform, you should supplement snapshots with application-level backup so you can selectively restore without having to roll back the entire VM.
Once an invoice has passed its due date, the account may be blocked and access to computing resources restricted. If, despite these measures, the outstanding debt is not settled, all instances will later be permanently shut down with no possibility to restart.
Most TLDs can be transferred. Unlock the domain at your current registrar, get the EPP/Auth code and start the transfer from your Bahnhof account.
Some registries impose a waiting period of 60-90 days after registration or changes; check the rules of your TLD if a transfer is denied. Keep DNS running during the move by avoiding name server changes until the move is complete.
Domain registrations are non-refundable as the registrar fees are locked in at the time of purchase. Check the spelling, choice of TLD and contact details before confirming payment to avoid costly mistakes.
Yes. Open the domain details page and turn off auto renew. The domain will expire at the end of the current period unless you renew manually. If you still need the domain, renew a few days before the expiration date to avoid late fees or redemption costs.
You can pay by credit card. Cryptocurrencies are not supported. Keep a valid card on file for automatic renewals to avoid service interruptions.
Annual billing is available for many services. Switching reduces the number of invoices and the administrative overhead. Contact us on 010-510 00 00 to switch your plan to annual payment.
Invoices are often created in advance of the next period. If you cancel a service after the invoice has been created, you can still see the charge. Contact us on 010-510 00 00 and provide the termination reference and we will help you cancel or refund the invoice once we have confirmed that the service has indeed ended.
Refunds are limited. VPS plans are normally non-refundable once delivered, except in case of platform failure or double billing. Domains are not refundable. If you believe you have been misbilled, please contact us at 010-510 00 00 to start a customer service case.
VAT handling follows local tax rules. For usage-based VPC, a monthly VAT invoice sums up the consumption. Keep your company details and VAT number up to date in your profile for proper VAT management.
A VPS is a server with pre-configured size. It is good for small projects with light to medium load and quick experiments. VPC exposes an OpenStack project where you design networks, connect volumes, and scale out with multiple instances or load balancers. Aside from small one-off projects, VPC is usually the better option.
Yes, but in-house. Bahnhof does not provide managed Kubernetes clusters.
It is possible in a VPC. Use Horizon or Skyline to upload a bootable image and create instances from it or attach an ISO image to reinstall a VM.
PTR is not offered for public addresses in VPS/VPC.
If encryption at rest is a requirement, you can use file systems such as LUKS inside the guest or choose an application-level approach where data is encrypted before it is written to disk.
Bandwidth and CPU policy differ between the size of the instances and are optimized for typical small business and developer scenarios. Short peak loads are fine, but long term high loads can be limited by fair use policy on the shared infrastructure.
If you expect constant heavy traffic, large databases or CPU-heavy calculations, look at VPC with more powerful instances or a dedicated server for more predictable capacity.
Small, Medium and Large instances have bandwidth limits of 100 Mbps (not burstable), 150 Mbps (burstable to 200 Mbps) and 250 Mbps (burstable to 500 Mbps) respectively.
Yes.
Some data must be kept to comply with Swedish law, so the account cannot be completely deleted. However, we can close your account, stop renewals and delete non-essential personal data while preserving legally required information. You can still request copies of invoices and historical records if necessary.
You can run email software, but without a PTR on the VPS/VPC and with strict SMTP rules on the internet, delivery security becomes challenging.
For business-critical email, a specialized provider or a custom solution with proper rDNS, monitoring and reputation management is recommended. If you’re running email on a VPS anyway, forward outbound traffic via an SMTP service and secure your DNS with SPF, DKIM and DMARC.
The infrastructure includes network-level protection that intercepts common volumetric attacks before they reach your server. However, application-level protection (WAF, rate limiting, bot protection) remains your responsibility. Put a reverse proxy like Nginx or a CDN with WAF in front of your app if you expect targeted layer 7 attacks.
Trial accounts and special rates are not normally offered. The monthly model for VPS works in practice like a test: start an instance, try your load and cancel before the next period if it does not meet your needs.
Set the following environment variables before using the AWS CLI, Boto3 or other S3-compatible client:
export AWS_REGION=us-east-1
export AWS_DEFAULT_REGION=us-east-1
export AWS_ACCESS_KEY_ID=
export AWS_SECRET_ACCESS_KEY=
export AWS_ENDPOINT_URL_S3=https://s3-sto.bahnhof.cloud
export AWS_ENDPOINT_URL_IAM=https://iam-s3-sto.bahnhof.cloud
export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
Once the variables are set, standard commands work as usual:
aws s3 lsaws s3 cp minfil.txt s3://min-bucket/aws s3 ls s3://min-bucket/