{"id":743,"date":"2023-09-27T01:53:00","date_gmt":"2023-09-27T01:53:00","guid":{"rendered":"https:\/\/blog.ngocha.biz\/?p=743"},"modified":"2023-09-27T01:53:00","modified_gmt":"2023-09-27T01:53:00","slug":"generate-ssh-key-pair","status":"publish","type":"post","link":"https:\/\/blog.ngocha.biz\/?p=743","title":{"rendered":"How to Generate SSH Key (Public\/Private) – Beginners Guide"},"content":{"rendered":"

SSH (Secure Shell) Key is the secure way to log in to Linux servers as compared to passwords.<\/p>\n

Every DevOps engineer has to use SSH key-based authentication when working with Linux servers. Also, most cloud platforms offer and recommend SSH key-based server authentication for enhanced security<\/p>\n

This blog post aims to provide a detailed, step-by-step guide on how to create an SSH key pair for authenticating Linux servers and applications that support SSH protocol using SSH-keygen.<\/a><\/p>\n

SSH-Keygen<\/h2>\n

ssh-keygen<\/code><\/strong> is the utility to create SSH keys. It is part of every Linux and MAC system.<\/p>\n

You can use the man command below to understand the ssh-keygen<\/code><\/strong> utility and all available options.<\/p>\n

man ssh-keygen<\/code><\/pre>\n
Or you can refer to the ssh-keygen online man page<\/a><\/p>\n
Let’s look at different ways and options to generate SSH keys.<\/p>\n
Steps to Create an SSH Key<\/h2>\n
Follow the steps given below to create an SSH key.<\/p>\n
Step 1: Open the Terminal<\/h3>\n
Open the workstation terminal if you are using a laptop to Desktop.<\/p>\n
If you are using a headless server, proceed to the next step.<\/p>\n
Step 2: Generate the Key Pair<\/h3>\n
Execute the following ssh-keygen<\/code><\/strong> command to generate the SSH key pair. It generates and saves the Keys in the default $HOME\/.ssh<\/code><\/strong> location. By default,  the private key is named as id_rsa<\/code><\/strong> , and the public key is named as id_rsa.pub<\/code><\/strong><\/p>\n
ssh-keygen<\/code><\/pre>\n
Step 3: Save the Key<\/h3>\n
The ssh-keygen<\/strong> command will prompt for the following options.<\/p>\n
    \n
  1. Enter the file in which to save the key<\/strong>:- Local path of the SSH private key to be saved. If you don’t specify any location, it gets stored in the default SSH location. ie, $HOME\/.ssh<\/code><\/strong><\/li>\n
  2. Enter passphrase<\/strong>: A passphrase is used to protect the SSH private key. You can leave this empty. If you choose to add a passphrase, you will have to enter it again.<\/li>\n<\/ol>\n
    \"SSH<\/figure>\n
    Step 3: Key Created<\/h3>\n
    You’ve successfully created an SSH key pair. You’ll find two files: id_rsa<\/code> (private key) and id_rsa.pub<\/code> (public key), usually in the ~\/.ssh\/<\/code> directory.<\/p>\n
    Generate SSH Keys With Custom Options<\/h2>\n
    Let’s take a look at an example ssh-keygen<\/code> command to generate SSH keys with custom options.<\/p>\n
    The following command generates an SSH key named ssh-key in the $HOME\/.ssh<\/code> location with username vagrant<\/code> with -C flag and passphrase mysecret<\/code> with -q -P<\/code> flag.<\/p>\n
    ssh-keygen -t rsa -f ~\/.ssh\/ssh-key -C vagrant -b 4096 -q -P \"mysecret\"<\/code><\/pre>\n
    Let’s understand the flags.<\/p>\n
      \n
    1. -t rsa<\/strong>: It is the ssh key algorithm. It is the default algorithm used by ssh-keygen<\/code>.<\/li>\n
    2. -f :<\/strong> keyfile name.<\/li>\n
    3. -q -P: <\/strong> To add passphrase without prompt<\/li>\n
    4. -b:<\/strong> Key Encryption Level. The default is 2048 bits<\/li>\n
    5. -C:<\/strong> To set the comment in the last line of the public key. It is typically used to replace the default username set by the command. You can also use this flag to set the server username.<\/li>\n<\/ol>\n
      If you add the Linux username to the key file with -C<\/code> , you can directly perform SSH without specifying the username in the SSH command.<\/p>\n
      For example,<\/p>\n
      ssh -i ~\/.ssh\/ssh-key 192.81.209.247<\/code><\/pre>\n
      If you don’t want a passphrase and create the keys without a passphrase prompt, you can use the flag -q -N<\/code> as shown below.<\/p>\n
      ssh-keygen -t rsa -f ~\/.ssh\/ssh-key -C vagrant -b 2048 -q -N \"\"<\/code><\/pre>\n
      How to Use Your SSH Key<\/h2>\n
      Now that you have created the SSH key, you can use it as a server for SSH authentication.<\/p>\n
      Here is how you can do it.<\/p>\n
      Use ssh-copy-id<\/code> command or manually place the id_rsa.pub<\/code> file content into the ~\/.ssh\/authorized_keys<\/code> file on the remote server.<\/p>\n
      Use the ssh command as given below<\/p>\n
      ssh username@remote_server<\/code><\/pre>\n
      If you have saved the SSH key with a different name other than id_rsa to save it to a different location, use the following format.<\/p>\n
      ssh -i \/path\/to\/private-key-file username@remote_server<\/code><\/pre>\n
      For example,<\/p>\n
      ssh -i ~\/.ssh\/ec2-server.pem ubuntu@34.56.76.34<\/code><\/pre>\n
      Supported SSH key algorithms<\/h2>\n
      SSH (Secure Shell) supports multiple key algorithms for better security. The following are the supported SSH key algorithms.<\/p>\n
        \n
      1. Rivest-Shamir-Adleman (RSA):<\/a> <\/strong>Generally considered secure with key lengths of at least 2048 bits.<\/li>\n
      2. Digital Signature Algorithm (DSA):<\/a> Limited to 1024-bit key length, making it less secure.<\/li>\n
      3. Elliptic Curve Digital Signature Algorithm (ecdsa): <\/strong><\/a>Provides high security with shorter key lengths (256-bit and above).<\/li>\n
      4. Ed25519 <\/a>– EdDSA signature scheme using SHA-512 (SHA-2) and Curve25519. It offers High security with a 256-bit key length.<\/li>\n<\/ol>\n
        Choosing the algorithm depends on your security requirements. One real-world example is the Amazon ec2 ssh key pair. It supports ED25519 and 2048-bit SSH-2 RSA keys for Linux instances.<\/p>\n
        To check the algorithm of an existing key you can use the following command.<\/p>\n
        ssh-keygen -l -f ~\/.ssh\/id_rsa<\/code><\/pre>\n
        SSH Key FAQs<\/h2>\n
        How do I manually generate SSH keys?<\/h3>\n
        You can manually generate the SSH key using the ssh-keygen command. It creates the public and private in the $HOME\/.ssh location.<\/p>\n
        Is it possible to use ssh-keygen to create an SSH key without a passphrase?<\/h3>\n
        Yes. If you leave the passphrase prompt empty, the ssh keys get generated without any password. You can also pass the flag -q -N “” to the ssh-keygen command to avoid the prompt.<\/p>\n
        What if I lose my SSH key?<\/h3>\n
        If you lose your private key, remove its corresponding public key from your server’s authorized_keys<\/code> file and create a new key pair. It is recommended to save the SSH keys in a secret management tool.<\/p>\n
        Can I use the same SSH key for multiple servers?<\/h3>\n
        Yes, you can use the same public key on multiple servers. You just need to add it to each server’s authorized_keys<\/code> file under ~\/.ssh directory. <\/p>\n
        How to create an SSH key online?<\/h3>\n
        It is advisable not to use any online services to create SSH keys. As a standard security best practice, use the ssh-keygen command to create the SSH key.<\/p>\n
        Conclusion<\/h2>\n
        In this guide, we looked at important commands to create SSH public\/private key pairs. It adds a critical layer of security to your Linux systems.<\/p>\n
        When it comes to SSH keys, always follow the security best practices to avoid private key misuse.<\/p>\n
        If you are learning Linux, check out the Best Linux Networking and Troubleshooting Commands<\/a>.<\/p>\n
        Also, If you are starting your journey as a DevOps Engineer, check out my DevOps Engineer Roadmap<\/a>.<\/p>\n
        Note<\/strong>: Always follow best security practices when dealing with SSH keys to ensure your systems remain secure.<\/p><\/blockquote>\n
        \n
        Ngu\u1ed3n:<\/strong> How to Generate SSH Key (Public\/Private) – Beginners Guide \u2014 DevOpsCube<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
        Source: https:\/\/devopscube.com\/generate-ssh-key-pair\/<\/p>\n","protected":false},"author":1,"featured_media":744,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-743","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/posts\/743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=743"}],"version-history":[{"count":0,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/posts\/743\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=\/wp\/v2\/media\/744"}],"wp:attachment":[{"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ngocha.biz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}