SSH key generation (ssh-keygen) in Linux CLI - Commands & Configuration

Introduction

SSH keys let you connect securely to other computers without typing a password every time. Generating SSH keys creates a pair of files: one public and one private, which work together to prove who you are.

When you want to log into a remote server without entering your password each time.

When setting up secure communication between your computer and a cloud service.

When automating scripts that need to connect to other machines securely.

When you want to improve security by using keys instead of passwords.

When configuring Git to push code to repositories without typing your password.

Commands

This command creates a new RSA SSH key with 4096 bits and labels it with your email. It starts the process of generating your key pair.

Terminal

ssh-keygen -t rsa -b 4096 -C "[e-mail]"

Expected Output

Generating public/private rsa key pair.

Enter file in which to save the key (/home/user/.ssh/id_rsa): 

→

-t rsa - Specifies the type of key to create, here RSA.

→

-b 4096 - Sets the key length to 4096 bits for stronger security.

→

-C "[e-mail]" - Adds a comment to the key, usually your email, to identify it.

After pressing Enter to accept the default file location, you will be asked to enter a passphrase. You can press Enter twice to skip the passphrase or type one for extra security.

Terminal

ssh-keygen -t rsa -b 4096 -C "[e-mail]"

Expected Output

Enter file in which to save the key (/home/user/.ssh/id_rsa): 

Enter passphrase (empty for no passphrase): 

Enter same passphrase again: 

Your identification has been saved in /home/user/.ssh/id_rsa

Your public key has been saved in /home/user/.ssh/id_rsa.pub

The key fingerprint is:

SHA256:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX [e-mail]

The key's randomart image is:

+---[RSA 4096]----+

|    .o+*o.       |

|   . +o=+        |

|    + +o.        |

|   . + .         |

|    . S          |

|                 |

|                 |

|                 |

|                 |

+----[SHA256]-----+

This command lists the private and public SSH key files to confirm they were created successfully.

Terminal

ls -l ~/.ssh/id_rsa*

Expected Output

-rw------- 1 user user 3243 Jun  1 12:00 /home/user/.ssh/id_rsa

-rw-r--r-- 1 user user  743 Jun  1 12:00 /home/user/.ssh/id_rsa.pub

→

-l - Shows detailed file information including permissions and size.

This command displays your public SSH key, which you can copy and add to remote servers or services to allow secure access.

Terminal

cat ~/.ssh/id_rsa.pub

Expected Output

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3... [e-mail]

Key Concept

If you remember nothing else from this pattern, remember: ssh-keygen creates a secure pair of keys that let you connect safely without passwords.

Common Mistakes

Not specifying the key type or using weak defaults.

Older defaults may create weaker keys that are less secure.

Always specify a strong key type like RSA with 4096 bits using -t rsa -b 4096.

Saving the key in a non-default location without updating SSH configs.

SSH won't find your key automatically if it's not in the default place.

Either accept the default location or update your SSH config to point to the custom key path.

Leaving the passphrase empty without understanding the risk.

Without a passphrase, if someone gets your private key file, they can use it immediately.

Use a passphrase for extra security unless you have a specific reason not to.

Summary

Use ssh-keygen with -t rsa -b 4096 -C to create a strong SSH key pair.

Confirm the keys are created by listing the files in ~/.ssh directory.

Copy the public key content to remote servers to enable passwordless login.

Practice

1. What is the primary purpose of the ssh-keygen command in Linux?

easy

A. To start an SSH server on the local machine

B. To generate a pair of cryptographic keys for SSH authentication

C. To connect to a remote server using SSH

D. To display the current SSH connections

Solution

1. Step 1: Understand the function of ssh-keygen

   The ssh-keygen command is used to create a pair of keys: a private key and a public key, which are used for secure SSH authentication.

2. Step 2: Differentiate from other SSH commands

   Starting an SSH server or connecting to a server uses different commands like sshd or ssh. Displaying connections is unrelated.

3. Final Answer:

   To generate a pair of cryptographic keys for SSH authentication -> Option B

4. Quick Check:

   ssh-keygen creates keys = B [OK]

Hint: ssh-keygen always creates keys, not connections or servers [OK]

Common Mistakes:

• Confusing ssh-keygen with ssh command
• Thinking ssh-keygen starts SSH server
• Assuming ssh-keygen shows active connections

2. Which of the following is the correct syntax to generate an RSA SSH key pair with ssh-keygen?

easy

A. ssh-keygen -t rsa

B. ssh-keygen -g rsa

C. ssh-keygen --generate rsa

D. ssh-keygen -type rsa

Solution

1. Step 1: Identify the correct option flag for key type

   The -t flag specifies the type of key to generate, such as rsa, dsa, or ed25519.

2. Step 2: Check the syntax correctness

   Only ssh-keygen -t rsa is valid syntax. Other options like -g, --generate, or -type are invalid or do not exist.

3. Final Answer:

   ssh-keygen -t rsa -> Option A

4. Quick Check:

   -t specifies type = D [OK]

Hint: Use -t to specify key type in ssh-keygen [OK]

Common Mistakes:

• Using -g instead of -t for key type
• Adding extra words like --generate
• Using -type instead of -t

3. What will be the output of the following command if the default key files already exist?

ssh-keygen -t ed25519

medium

A. It throws an error and exits immediately

B. It overwrites the existing key files without warning

C. It prompts to overwrite the existing files or choose a new name

D. It generates a new key with a random filename automatically

Solution

1. Step 1: Understand ssh-keygen behavior on existing files

   When key files already exist, ssh-keygen asks the user if they want to overwrite or specify a new filename.

2. Step 2: Confirm it does not overwrite silently or error out

   It does not overwrite without confirmation, nor does it throw an error or generate random filenames automatically.

3. Final Answer:

   It prompts to overwrite the existing files or choose a new name -> Option C

4. Quick Check:

   ssh-keygen asks before overwrite = A [OK]

Hint: ssh-keygen asks before overwriting existing keys [OK]

Common Mistakes:

• Assuming it overwrites files silently
• Expecting an error instead of prompt
• Thinking it auto-generates random filenames

4. You ran ssh-keygen -t rsa -b 4096 but got an error: unknown option: -b. What is the most likely cause?

medium

A. The command requires sudo privileges to use -b

B. The -b option is invalid for RSA keys

C. You must specify the key filename before the -b option

D. You used an outdated ssh-keygen version that does not support the -b option

Solution

1. Step 1: Understand the -b option usage

   The -b option sets the number of bits for the key size and is valid for RSA keys.

2. Step 2: Identify why the error occurs

   An unknown option error usually means the ssh-keygen version is old and does not recognize the -b flag.

3. Final Answer:

   You used an outdated ssh-keygen version that does not support the -b option -> Option D

4. Quick Check:

   Old ssh-keygen lacks -b support = A [OK]

Hint: Check ssh-keygen version if options cause unknown errors [OK]

Common Mistakes:

• Thinking -b is invalid for RSA
• Believing filename order matters for options
• Assuming sudo is needed for key size

5. You want to automate SSH key generation in a script without any prompts, saving the key as ~/.ssh/id_ed25519_custom. Which command correctly achieves this?

hard

A. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -N ''

B. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom

C. ssh-keygen -t ed25519 -N ''

D. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -y

Solution

1. Step 1: Understand flags for silent key generation

   The -f flag sets the filename, and -N '' sets an empty passphrase to avoid prompts.

2. Step 2: Check each option for automation suitability

   ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -N '' uses both -f and -N '' correctly. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom misses -N so it prompts for passphrase. ssh-keygen -t ed25519 -N '' misses filename, so default is used. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -y uses -y which outputs public key but does not generate keys silently.

3. Final Answer:

   ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -N '' -> Option A

4. Quick Check:

   Use -f for file and -N '' for no passphrase = C [OK]

Hint: Use -f for file and -N '' for no passphrase to avoid prompts [OK]

Common Mistakes:

• Omitting -N '' causes passphrase prompt
• Forgetting to specify filename with -f
• Using -y which only outputs public key