SSH Key pair creation

Bystuart

Creating secure SSH keys in Linux is straightforward and follows best practices to ensure the keys are secure. Here’s a step-by-step guide:

1. Generate the SSH Key Pair

Run the following command to generate an SSH key pair:

ssh-keygen -t ed25519 -C "your_email@example.com"
  • -t ed25519: Specifies the key type. Ed25519 is recommended for better security and performance.
  • -C "your_email@example.com": Adds a comment (usually your email) for easier identification of the key.

Alternative (RSA): If you need compatibility with older systems, use RSA with a strong key length:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

2. Specify the File Location

The tool will prompt you for the file location. Press Enter to use the default path (~/.ssh/id_ed25519) or provide a custom path.

3. Set a Passphrase

When prompted, enter a secure passphrase. This adds an additional layer of security in case your private key file is compromised.

4. Secure the Private Key

Ensure the private key file has the correct permissions:

chmod 600 ~/.ssh/id_ed25519

5. Add the Key to Your SSH Agent

Start the SSH agent and add your key:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

6. Copy the Public Key to a Server

Use the ssh-copy-id command to copy your public key to the remote server:

ssh-copy-id username@remote_host

Alternatively, manually copy the contents of the public key (~/.ssh/id_ed25519.pub) and add it to the server’s ~/.ssh/authorized_keys file.

7. Verify Key-Based Authentication

Test the connection to ensure it works without prompting for a password:

ssh username@remote_host

Best Practices

  1. Use Ed25519: It’s faster and more secure than RSA for most use cases.
  2. Use a Strong Passphrase: Combine uppercase, lowercase, numbers, and symbols.
  3. Limit Key Use: Create separate keys for different servers/accounts.
  4. Enable Two-Factor Authentication: If supported by the server, enable 2FA for an extra layer of security.
  5. Regularly Rotate Keys: Replace old keys periodically to reduce the risk of compromise.

Would you like guidance on securing your SSH server or troubleshooting any issues?