ssh key generation and use

ssh key generation and use

Always remember the relevant files and folders must have non-public permissions, otherwise there will be ambiguous error messages and absolute failure.

No need to have SSH access in order to use an SSH key for just SFTP because the key can be transferred by SFTP to the appropriate path.

The passphrase is recommended as at least 10–30 characters, any characters, therefore a phrase more so than a word.

Possible to have an empty passphrase, which then results in no need to unlock the key each time, therefore login needs only username and destination. Either way, a single key can be for many different uses. The former contradicts the typical recomendation of always having a strong password, and the latter contradicts never using the same authentication anywhere else.

On the other hand, an SSH key allows for access to an account while neither needing nor revealing the account password. That means nothing that requires the password can be done in the account when only the key is known.

generate an ssh key

Generate a key with the latest format using -o. Use -b to specify the number of bits; 1024 is minimum, 2048 is default. The comment is set with -C, since the default is something like "user@host.local".

ssh-keygen -o -t rsa -C "description"

Or change comment afterwards with -c.

ssh-keygen -c

Obscure the hostnames and addresses in the "known_hosts" file.

ssh-keygen -H

Either copy the key to "~/.ssh/authorized_keys" on the other host, or use the ssh copy command to have it appended automatically (optionally specifying the server).

ssh-copy-id -i ~/.ssh/ user@[server.]domain.tld

Test the connection.

ssh login@machine.domain.tld

Change passphrase.

ssh-keygen -p

Generate a new host key and replace the current key. Useful when the remote host identification has changed.

ssh-keygen -R domain.tld

More in: