Linux · sockets & transfer

ssh-keygen

make an SSH key

ssh-keygen generates a pair of keys. The public key is copied to servers; the private key never leaves your machine. A server that holds your public key can check that you hold the private one — a login with no password sent at all.

The .pub file can go anywhere. The other one is the secret.

Recommended type

ed25519

short, fast, strong

Creates

Two files

id_ed25519 and id_ed25519.pub

Passphrase

Set one

encrypts the private key on disk

Install with

ssh-copy-id

puts the public key on a server

At the terminal

Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.

user@netflow — bashopenssh-client

$ ssh-keygen -t ed25519 -C "user@netflow"

Generating public/private ed25519 key pair.

1Enter file in which to save the key (/home/user/.ssh/id_ed25519):

2Enter passphrase (empty for no passphrase):

3Your identification has been saved in /home/user/.ssh/id_ed25519

Your public key has been saved in /home/user/.ssh/id_ed25519.pub

The key fingerprint is:

SHA256:Zp4x0aB7mQe2Lk9sVh1TtR8cNw3yUo6dJfGiE5rXbHc user@netflow

4$ ssh-copy-id deploy@192.0.2.10

Number of key(s) added: 1

Illustrative session · names, sizes and dates are examples, and every address is from a documentation or private range

Reading the output

What the numbered lines are telling you

Where to save it

Pressing Enter accepts the default location, which is where ssh looks for keys.

The passphrase

It encrypts the private key file. Someone who copies the file still cannot use it without the passphrase.

Two files

The first is the private key — guard it. The .pub file is the public half, safe to share.

Installing the public key

ssh-copy-id appends it to ~/.ssh/authorized_keys on the server. From now on ssh logs in with the key.

Switches

A switch changes how the command behaves. These are the ones used day to day; man ssh-keygen lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.

-t TYPE: The key type: ed25519 or rsa.
-b BITS: Key size, for RSA.
-C COMMENT: A label stored with the key.
-f FILE: The file to write or read.
-p: Change the passphrase of an existing key.
-l: Show a key’s fingerprint.
-R HOST: Remove a host’s entries from known_hosts.
-y: Print the public key belonging to a private key.

Variations worth knowing

The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.

cat ~/.ssh/id_ed25519.pub

Prints your public key, to paste into GitHub or a server.

ssh-keygen -lf ~/.ssh/id_ed25519.pub

Shows a key’s fingerprint.

ssh-keygen -p -f ~/.ssh/id_ed25519

Changes or adds the passphrase on an existing key.

ssh-keygen -R 192.0.2.10

Removes a host from known_hosts, after a server has been rebuilt.

In cybersecurity

A private key is a password that is never typed and never expires — so look after it accordingly.

Always set a passphrase

An unprotected private key works for whoever copies the file. With a passphrase, a stolen laptop or backup does not hand over every server.

One key per device

Do not copy a private key between machines. Give each device its own key, so one can be revoked without affecting the rest.

Review authorized_keys

Each line in ~/.ssh/authorized_keys is someone who can log in as that user. An unrecognised key is a backdoor.

Protocols it shows

SSH

Read alongside

sshOpens an encrypted shell on another machine, and runs commands there as if you were sitting at it.scpCopies files between machines over SSH, with the same syntax as cp plus a host name.