Make the first SSH connection

The first connection establishes two identities. Your private key proves who you are. The server host key helps prove which machine answered.

Connect with the dedicated key and the Droplet IP address:

ssh -i ~/.ssh/digitalocean_notes root@203.0.113.10

Replace the example address with your Droplet address. OpenSSH displays a host-key fingerprint because this server is not in your local known_hosts file yet.

Do not accept an unfamiliar fingerprint automatically. Use the control-panel console available for the Droplet image and inspect the server’s public host key through that independent path. If the Recovery Console requires a password, follow DigitalOcean’s current root-password reset procedure first.

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Compare the fingerprint character by character. Accept the connection only when it matches. OpenSSH then records the host key locally and should show an Ubuntu shell prompt.

Collect the first evidence:

whoami
hostnamectl --static
cat /etc/os-release

You should see root, the hostname you chose, and the expected Ubuntu release.

If authentication fails with Permission denied (publickey), first check the username, IP address, and -i path. Then verify that the selected public key appears in the Droplet settings. Recreating an empty new Droplet with the correct key is often safer than weakening SSH authentication.

If OpenSSH later reports that the host identification changed, stop. A rebuild legitimately changes the key, but an unexpected change can mean the address now belongs to another server or the connection is being intercepted. Verify the new fingerprint through the recovery console before removing the old local entry.

Keep this root session open for the next lessons. Your action is to open a second terminal and make the same verified connection again. Two working sessions give you a recovery path while changing users, firewall rules, and SSH settings.