ssh-keygen

ssh-keygen is used to generate, manage, and convert authentication keys, including both RSA and DSA key types. The key type can be specified with the -t option; if not specified, an RSA key for SSH-2 is generated by default. ssh-keygen can also be used to generate the prime modulus used in Diffie-Hellman group exchange (DH-GEX) — see the moduli and generation section. Generally speaking, if a user wants to use RSA or DSA authentication, they should run this program at least once to create the necessary keys in ~/.ssh/identity, ~/.ssh/id_dsa, or ~/.ssh/id_rsa. In addition, system administrators can also use it to generate host keys. Typically, this program generates a key pair, asks you to specify a file to store the private key, and stores the public key in a file with the same name plus a “.pub” suffix. The program also asks for a passphrase string — empty means no passphrase (a host key’s passphrase must be empty). A passphrase is very similar to a password, but a passphrase can be a whole sentence, containing words, punctuation, digits, spaces, or any characters you like. A good passphrase is 30+ characters, hard to guess, and made up of a mix of upper/lowercase letters, digits, and non-alphabetic characters. The passphrase can be changed with the -p option. A lost passphrase cannot be recovered — if you lose or forget it, you must generate a new key and then distribute the corresponding public key to other machines. RSA1 key files have a “comment” field, which makes it easy for a user to identify the key, noting its purpose or other useful information. When a key is created, the comment field is initialized to “user@host”, and can be changed later with the -c option.

Parameters

-a trials the number of primality tests to perform when using -T to screen candidate DH-GEX primes for safety.

-B shows the bubblebabble digest of the specified public/private key file.

-b bits specifies the key length. For RSA keys, the minimum is 768 bits, with 2048 as the default. DSA keys must be exactly 1024 bits (as required by the FIPS 186-2 standard).

-C comment provides a new comment

-c requests changing the comment in the private and public key files. This option only supports RSA1 keys. The program will prompt for the private key filename, the passphrase (if one exists), and the new comment.

-D reader downloads the RSA public key stored on a smart card reader.

-e reads an OpenSSH private or public key file and displays it on stdout in RFC 4716 SSH public key file format.

This option can export keys for several commercial versions of SSH.

-F hostname searches the known_hosts file for the given hostname and lists all matches.

This option is mainly used to find hashed hostnames/IP addresses, and can be combined with the -H option to print the hash of the found public key.

-f filename specifies the key filename.

-G output_file generates candidate primes for DH-GEX. These primes must be screened for safety with the -T option before use.

-g uses the generic DNS format when printing a fingerprint resource record with -r.

-H hashes the known_hosts file. This replaces all hostnames/IP addresses in the file with their corresponding hash values.

The original file’s contents are saved with a “.old” suffix appended. These hash values can only be used by ssh and sshd. This option does not modify hostnames/IP addresses that are already hashed, so it can safely be used on a file where some public keys have already been hashed.

-i reads an unencrypted SSH-2-compatible private/public key file, then displays an OpenSSH-compatible private/public key on stdout. This option is mainly used to import keys from various commercial versions of SSH.

-l shows the fingerprint data of a public key file. It also supports RSA1 private keys.

For RSA and DSA keys, the corresponding public key file will be looked up, and then its fingerprint data displayed.

-M memory specifies the maximum memory usage (in MB) when generating DH-GEXS candidate primes.

-N new_passphrase provides a new passphrase.

-P passphrase provides the (old) passphrase.

-p requests changing a private key file’s passphrase without rebuilding the private key. The program will prompt for the private key filename, the original passphrase, and the new passphrase entered twice.

-q quiet mode. Used when creating a new key inside /etc/rc.

-R hostname removes all keys belonging to hostname from the known_hosts file.

This option is mainly used to remove the keys of a hashed host (see the -H option).

-r hostname prints the SSHFP fingerprint resource record for the public key file named hostname.

-S start specifies the starting point (in hex) when generating DH-GEX candidate moduli.

-T output_file tests the security of Diffie-Hellman group exchange candidate primes (generated by the -G option).

-t type specifies the type of key to create. Available values: “rsa1” (SSH-1), “rsa” (SSH-2), “dsa” (SSH-2)

-U reader uploads an existing RSA private key to a smart card reader

-v verbose mode. ssh-keygen will output detailed debugging information about the process. Commonly used for debugging modulus generation.

Repeating the -v option multiple times increases the verbosity (up to 3 times).

-W generator specifies the generator to use when testing candidate moduli for DH-GEX

-y reads a public key file in OpenSSH’s proprietary format, and displays the OpenSSH public key on stdout.

Example

makessh-keygen

Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
83:9b:5d:fe:e7:1a:15:c1:4d:d2:c3:20:8b:45:92:a7 root@localhost.localdomain
The key's randomart image is:
+--[ RSA 2048]----+
|         .o+ o=+.|
|         .+.o .=o|
|         .o.  . .|
|       . E     . |
|      . S .   .  |
|       + +   .   |
|      o . . .    |
|           . ..  |
|            o+.  |
+-----------------+

chmod 400 id_rsa.pub grants the public key 400 permissions

id_rsa is the private key; back it up locally and then delete it from the server.

service sshd restart restarts the ssh service