ssh-keygen

Wat het doet

Zo schrijf je het

ssh-keygen [-q] [-t TYPE] [-b BITS] [-C COMMENT] [-f FILE] [-N PASSPHRASE]
ssh-keygen -p [-f FILE]
ssh-keygen -l [-v] [-E HASH] -f FILE
ssh-keygen -R HOSTNAME [-f KNOWN_HOSTS]
ssh-keygen -F HOSTNAME [-f KNOWN_HOSTS]
ssh-keygen -s CA_KEY -I ID [-h] [-n PRINCIPALS] [-V VALIDITY] PUBKEY

Meest gebruikt

Niets past bij dit filter.

$ als gewone gebruiker# als root (of met sudo)

1. 1Make a modern key pair

   $ssh-keygen -t ed25519 -C "student@server1"

   Press Enter for the default file. Type a passphrase (recommended for people).

2. 2Make a key without passphrase for automation

   $ssh-keygen -t ed25519 -N "" -f ~/.ssh/backup_job -C "backup job server1"

   For cron jobs and CI. Protect the file and limit the key on the server.

3. 3Make an RSA key for old systems

   $ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_legacy

   Only when a device does not support ed25519.

4. 4Show the fingerprint of a key

   $ssh-keygen -lf ~/.ssh/id_ed25519.pub
   256 SHA256:Xh7… student@server1 (ED25519)

   Compare fingerprints when you check which key is allowed on a server.

5. 5Add or change a passphrase

   $ssh-keygen -p -f ~/.ssh/id_ed25519

   The key stays the same; only its protection changes. No change needed on servers.

6. 6Remove an old host key after a server reinstall

   $ssh-keygen -R server2

   Removes server2 from ~/.ssh/known_hosts. Verify the new key before you connect again.

7. 7Check a server's host key fingerprint on the server itself

   #ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

   Compare with the fingerprint your client shows at the first connect.

8. 8Get the public key back from a private key

   $ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub

   When the .pub file is lost.

9. 9Find a host in known_hosts

   $ssh-keygen -F server2

   Shows if (and which) key you trust for server2.

10. 10Recreate missing host keys on a server

    #ssh-keygen -A
    #systemctl restart sshd

    Needed after a VM template was cleaned of its host keys.

11. 11Sign a user key with your CA (short-lived access)

    $ssh-keygen -s ~/ca/user_ca -I alice-oncall -n alice -V +8h alice.pub

    Servers that trust the CA accept alice for 8 hours, without editing authorized_keys.

12. 12Sign a git commit file with an SSH key

    $ssh-keygen -Y sign -f ~/.ssh/id_ed25519 -n file release.tar.gz

    Makes release.tar.gz.sig. Others verify it with -Y verify.

Niets past bij dit filter.

Bestanden

~/.ssh/id_ed25519, ~/.ssh/id_ed25519.pub

Default user key pair.

~/.ssh/known_hosts

Trusted host keys.

/etc/ssh/ssh_host_*_key

The host keys of the server.