Difference between revisions of "Ssh-keygen (command)"

Latest revision as of 15:46, 8 May 2024

ssh-keygen^[1] is an OpenSSH software command used to generate, manage, and convert authentication keys. It support at least four different key types RSA, DSA, ECDSA and ed25519.

https://www.man7.org/linux/man-pages/man1/ssh-keygen.1.html

~/.ssh/

Commands[edit]

Generate a key par[edit]

ssh-keygen
ssh-keygen -t ed25519 (There is no need to set the key size, as all ed25519 keys are 256 bits) other options:

Two files will be generated, one your private key and a second file containing second key (.pub extension)

ssh-keygen -t ed25519 -f ~/.ssh/your_new_ed25519_key

ssh-keygen -t ed25519 -f ~/.ssh/your_new_ed25519_key -C "your_coment_or_email_address

ssh-keygen -t rsa
ssh-keygen -t rsa -f your_new_rsa_key

ssh-keygen -A Generate all (-A) rsa, dsa, ecdsa and ed25519 key types.

Generate FIDO key:
ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk
Generating public/private ecdsa-sk key pair.

Generate with PEM format:

ssh-keygen -m PEM
ssh-keygen -m PEM -t rsa -f your_new_rsa_key.pem

Convert[edit]

ssh-keygen -e -m PEM -f private_key_in_ed25519_format
do_convert_to_pem: unsupported key type ED25519

ssh-keygen -l -f ~/.ssh/ssh_host_XXXXkey.pub
-l Show fingerprint of specified public key file.

.ssh_host_XXXXkey.pub is not a public key file.

Legacy format[edit]

^[2]

ssh-keygen -l -E md5 -f ~/.ssh/ssh_host_XXXXkey.pub

Changelog[edit]

OpenSSH 7.8, released in August 2018 Incompatible changes: ssh-keygen write OpenSSH format private keys by default instead of using OpenSSL's PEM format.

Activities[edit]

Generate a new public private key using ed25519 key format using the following command:

ssh-keygen -t ed25519

Solve" "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" warning:

ssh-keygen -R SERVER_NAME -R Removes all keys belonging to hostname from a known_hosts file

ssh -oStrictHostKeyChecking=no SERVER_NAME Temporarily turning off host key checking

Both solutions have security implications.

Understand different key types: dsa, ecdsa, ed25519 and RSA

Change or encrypt private key withouth changing the key: ^[4]

ssh-keygen -f ~/.ssh/id_rsa -p

Generate public key from private key:

ssh-keygen -y -f ~/.ssh/id_rsa > ~./.ssh/id_rsa.pub

Generate a key par with old PEM format using:

ssh-keygen -m PEM

Changing the private key's passphrase without changing the key^[5]

ssh-keygen -f ~/.ssh/id_rsa -p

-p change the passphrase of a private key file

Generate fingerprint or ID of a key

ssh-keygen -lf your_key.pub
2048 SHA256:u6IaFqRcwp0QX0nPBa/HHB2k/g73tH+YkoaE0riGRAT NAME@XX (RSA)

ssh-keygen -lf your_key
your_key is not a key file.

Related terms[edit]

ssh-copy-id
openssl: openssl rsa, openssl genrsa, openssl req
puttygen (PuTTY)
0600
Cisco IOS/Configure public RSA key authentication
Terraform resource: tls_private_key
aws ec2 create-key-pair
gcloud iam service-accounts keys create
gcloud kms keys create
gpg --gen-key
Terraform: aws_key_pair
Create new x509 certificate: openssl req -x509 -newkey
geth account new

See also[edit]

ssh-keygen [ -R, -t | -p | -i | -y | -f | ~/.ssh/id_rsa | --help ] ~/.ssh/known_hosts
OpenSSH (changelog): /etc/ssh/sshd_config | /etc/ssh/ssh_config | ~/.ssh/ | openSSL | sshd logs | sftp | scp | authorized_keys | ssh-keygen | ssh-keyscan | ssh-add | ssh-agent | ssh | Ssh -O stop | ssh-copy-id | CheckHostIP | UseKeychain, OpenSSF
AAA, Kerberos, KDC, kinit, klist, ktutil, /etc/krb5.conf, krb5-workstation, pam_krb5
Public key cryptography, private key, public key, key length, ssh-keygen, ssh-keyscan, Root certificate, KEX, Generate a key

↑ http://man7.org/linux/man-pages/man1/ssh-keygen.1.html

↑ https://superuser.com/questions/421997/what-is-a-ssh-key-fingerprint-and-how-is-it-generated

↑ https://www.openssh.com/txt/release-8.1

↑ https://wiki.archlinux.org/index.php/SSH_keys#Changing_the_private_key's_passphrase_without_changing_the_key

[1]

[2]

[3]

[4]

[5]

@@ Line 1: / Line 1: @@
-<code>ssh-keygen</code><ref>http://man7.org/linux/man-pages/man1/ssh-keygen.1.html</ref> is an [[OpenSSH]] software command used to generate, manage, and convert [[authentication keys]]. It support at least four different key types [[RSA]], [[DSA]], [[ECDSA]] and [[ed25519]].
+{{lowercase}}
+<code>ssh-keygen</code><ref>http://man7.org/linux/man-pages/man1/ssh-keygen.1.html</ref> is an [[OpenSSH]] software command used to generate, manage, and convert [[authentication keys]]. It support at least four different [[key]] types [[RSA]], [[DSA]], [[ECDSA]] and [[ed25519]].
+* https://www.man7.org/linux/man-pages/man1/ssh-keygen.1.html
-==Commands==
+ [[~/.ssh/]]
-Generate a keypar:
-* <code>ssh-keygen -t [[ed25519]]</code> (There is no need to set the key size, as all Ed25519 keys are 256 bits) other options:
-<code>[-t [[dsa]] | [[ecdsa]] | [[ecdsa-sk]] | [[ed25519]] | [[ed25519-sk]] | [[rsa]]]</code>
-:::::Two files will be generated, one your private key and a second file containing second key (<code>.pub</code> extension)
+== Commands ==
+* <code>[[ssh-keygen --help]]</code>
+* <code>[[ssh-keygen -s]]</code>
+* <code>[[ssh-keygen -p]]</code>
-* <code>ssh-keygen -t ed25519 -f your_new_ed25519_key</code>
+== Generate a key par ==
+* <code>[[ssh-keygen]]</code>
+* <code>[[ssh-keygen -t ed25519]]</code> (There is no need to set the [[key size]], as all [[ed25519]] keys are 256 bits) other options:
+<code>[-t [[dsa]] | [[ecdsa]] | [[ecdsa-sk]] | [[ed25519]] | [[ed25519-sk]] | [[ssh-keygen -t rsa|rsa]]]</code>
+:::::Two files will be generated, one your private key and a second file containing second key (<code>[[.pub]]</code> extension)
+* <code>ssh-keygen -t ed25519 -f ~/.ssh/your_new_ed25519_key</code>
+* <code>ssh-keygen -t ed25519 -f ~/.ssh/your_new_ed25519_key -C "your_coment_or_email_address</code>
+* <code>[[ssh-keygen -t rsa]]</code>
 * <code>ssh-keygen -t [[rsa]] -f your_new_rsa_key</code>
-* <code>ssh-keygen -A</code> Generate all (<code>-A</code>) [[rsa]], [[dsa]], [[ecdsa]] and [[ed25519]] key types.
+* <code>[[ssh-keygen -A]]</code> Generate all (<code>-A</code>) [[rsa]], [[dsa]], [[ecdsa]] and [[ed25519]] key types.
 * Generate [[FIDO]] key:
-  ssh-keygen -t [[ecdsa-sk]] -f ~/.ssh/id_ecdsa_sk
+*<code>ssh-keygen -t [[ecdsa-sk]] -f ~/.ssh/id_ecdsa_sk</code>
-  Generating public/private ecdsa-sk key pair.
+*<code>Generating public/private ecdsa-sk key pair.</code>
+Generate with [[PEM]] format:
+* <code>[[ssh-keygen -m]] [[PEM]]</code>
+* <code>ssh-keygen -m PEM -t rsa -f your_new_rsa_key[[.pem]]</code>
-* Convert:
+== Convert ==
   ssh-keygen -e -m [[PEM]] -f private_key_in_ed25519_format
   do_convert_to_pem: unsupported key type [[ED25519]]
 * <code>ssh-keygen -l -f ~/.ssh/ssh_host_XXXXkey.pub</code>
-  -l      Show [[fingerprint]] of specified public key file.
+* <code>-l      Show [[fingerprint]] of specified public key file.</code>
- .ssh_host_XXXXkey.pub is not a public key file.
+* <code>.ssh_host_XXXXkey.pub is not a public key file.</code>
-Legacy format: <ref>https://superuser.com/questions/421997/what-is-a-ssh-key-fingerprint-and-how-is-it-generated</ref>
+===Legacy format===
+<ref>https://superuser.com/questions/421997/what-is-a-ssh-key-fingerprint-and-how-is-it-generated</ref>
 * <code>ssh-keygen -l -E [[md5]] -f ~/.ssh/ssh_host_XXXXkey.pub</code>
-See also: [[puttygen]] -O fingerprint
+See also: [[puttygen]] -O [[fingerprint]]
 * <code>ssh-keygen -vF host</code> (-v flag added in OpenSSH 8.1<ref>https://www.openssh.com/txt/release-8.1</ref>)
@@ Line 37: / Line 54: @@
 == Changelog ==
 * [[OpenSSH 7.8]], released in August 2018 Incompatible changes: ssh-keygen write OpenSSH format private keys by default instead of using [[OpenSSL]]'s [[PEM]] format.
 ==Activities==
@@ Line 43: / Line 59: @@
 :::<code>ssh-keygen -t ed25519</code>
 * Solve" "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" warning:
-::<code>ssh-keygen -R SERVER_NAME</code> -R Removes all keys belonging to hostname from a known_hosts file
+::<code>ssh-keygen -R SERVER_NAME</code> -R Removes all keys belonging to hostname from a <code>[[known_hosts]]</code> file
 ::<code>ssh -oStrictHostKeyChecking=no SERVER_NAME</code> Temporarily turning off host key checking
 :::Both solutions have security implications.
 * Understand different key types: <code>[[dsa]]</code>, <code>[[ecdsa]]</code>, <code>[[ed25519]]</code> and <code>[[RSA]]</code>
+* Change or encrypt private key withouth changing the key: <ref>https://wiki.archlinux.org/index.php/SSH_keys#Changing_the_private_key's_passphrase_without_changing_the_key</ref>
+<code>[[ssh-keygen -f]] ~/.ssh/id_rsa -p</code>
 * Generate [[public key]] from [[private key]]:
-::<code>ssh-keygen -y -f ~/.ssh/id_rsa > ~./.ssh/id_rsa.pub</code>
+::<code>[[ssh-keygen -y]] -f ~/.ssh/id_rsa > ~./.ssh/[[id_rsa.pub]]</code>
 * Generate a key par with old [[PEM]] format using:
-::<code>ssh-keygen -m [[PEM]]</code>
+::<code>[[ssh-keygen -m]] [[PEM]]</code>
 * Changing the private key's passphrase without changing the key<ref>https://wiki.archlinux.org/index.php/SSH_keys#Changing_the_private_key's_passphrase_without_changing_the_key</ref>
-<code>ssh-keygen -f ~/.ssh/id_rsa -p</code>
+<code>ssh-keygen -f ~/.ssh/[[id_rsa]] -p</code>
 : <code>-p</code> change the passphrase of a private key file
-* Generate fingerprint or ID of a key
+* Generate [[fingerprint]] or ID of a key
-  ssh-keygen -lf your_key.pub
+  [[ssh-keygen -lf]] your_key.pub
 SHA256:u6IaFqRcwp0QX0nPBa/HHB2k/g73tH+YkoaE0riGRAT NAME@XX (RSA)
@@ Line 64: / Line 83: @@
   your_key is not a key file.
-== Related commands ==
+== Related terms ==
 * <code>[[ssh-copy-id]]</code>
-* <code>[[openssl]]</code>: <code>openssl [[rsa]] -in mykey.pem -pubout > mykey.pub</code>, <code>[[openssl genrsa]]</code>
+* <code>[[openssl]]</code>: <code>[[openssl rsa]]</code>, <code>[[openssl genrsa]]</code>, <code>[[openssl req]]</code>
 * <code>[[puttygen]]</code> ([[PuTTY]])
+* [[0600]]
+* [[Cisco IOS/Configure public RSA key authentication]]
+* [[Terraform resource]]: <code>[[Terraform resource: tls private key|tls_private_key]]</code>
+* <code>[[aws ec2 create-key-pair]]</code>
+* <code>[[gcloud iam service-accounts keys create]]</code>
+* <code>[[gcloud kms keys create]]</code>
+* <code>[[gpg --gen-key]]</code>
+* Terraform: <code>[[aws_key_pair]]</code>
+* Create new [[x509]] certificate: <code>[[Create new x509 certificate: openssl req -x509 -newkey|openssl req -x509 -newkey]]</code>
+* [[geth account new]]
 == See also ==
-* {{CA}}
+* {{ssh-keygen}}
-* {{ssh}}
-* {{passwd}}
 * {{OpenSSH}}
-* [[Kerberos]]
+* {{Kerberos}}
-* [[Cisco IOS/Configure public RSA key authentication]]
+* {{key}}
-[[Category:Server administration]]
+[[Category:OpenSSH]]
 [[Category:Cryptography]]
+[[Category:ssh-keygen]]
 [[Category:Security]]

Difference between revisions of "Ssh-keygen (command)"

Latest revision as of 15:46, 8 May 2024

Contents

Commands[edit]

Generate a key par[edit]

Convert[edit]

Legacy format[edit]

Changelog[edit]

Activities[edit]

Related terms[edit]

See also[edit]

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

Navigation

Tools