[updated 2020-09-20] Generating SSH keys (HOWTO) for your server (+ and your user)

There are MANY such guides on the internet – this one is probably not any different or better than those.
You should read the man-page for SSH-keygen.
THE best resource/book that I have read on the topic is SSH Mastery – Michael W Lucas. His books are generally some of the best on each topic he writes about.

Meanwhile, the quick & dirty (to delete existing and start fresh) looks like this….

Server keys

Normally you would (probably) do this

rm -f /etc/ssh/ssh_host*;
ssh-keygen -A; #this uses the defaults as described in <a href="https://man.openbsd.org/ssh-keygen" target="_blank" rel="noopener noreferrer">ssh-keygen man-page</a>

to get RSA keys.

IF you’d like non-standard (eg >2048 RSA, or max strength keys, or extra options, etc you need to specify the keys individually). These lines create max options for each key type (assuming your system uses default path of /etc/ssh/*

ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ''
ssh-keygen -t dsa -b 1024 -f /etc/ssh/ssh_host_dsa_key -N ''
ssh-keygen -t ecdsa -b 521 -f /etc/ssh/ssh_host_ecdsa_key -N ''
ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ''

To display/check your new keys (on the server/host), for each key, in both formats…

ssh-keygen -E md5 -lf /etc/ssh/ssh_host_rsa_key.pub;     ssh-keygen -E sha256 -lf /etc/ssh/ssh_host_rsa_key.pub;     echo
ssh-keygen -E md5 -lf /etc/ssh/ssh_host_dsa_key.pub;     ssh-keygen -E sha256 -lf /etc/ssh/ssh_host_dsa_key.pub;     echo
ssh-keygen -E md5 -lf /etc/ssh/ssh_host_ecdsa_key.pub;   ssh-keygen -E sha256 -lf /etc/ssh/ssh_host_ecdsa_key.pub;   echo
ssh-keygen -E md5 -lf /etc/ssh/ssh_host_ed25519_key.pub; ssh-keygen -E sha256 -lf /etc/ssh/ssh_host_ed25519_key.pub; echo

Different ssh connectors/apps display them in different formats. Keep a copy of the keys as a lookup for each of your servers/hosts so that you can check them when you connect (yes, you SHOULD check them!).

User keys

Create user keys on LOCAL workstation/client.
If you try to access any system using keys, you do actually have to have some. The lines below will create your keys that you can use to do passwordless logins to authenticated servers.

rm -f ~/.ssh/id_rsa;                               #[optional] remove existing
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N '';  #create a NEW workstation/client key pair with NO passphrase
                                                   #make sure you have added in any preferred settings/parameters!!!

Server keys

User keys

You may also like these posts:

archlinux: my preferred desktop/workstation apps for daily use

Debian security/vulnerability checks & audits

[UPD:2020-10-16] Passwordless SSH login & filesystem mount (HOWTO)

Leave a Reply Cancel reply