SSH key generation (ssh-keygen) in Linux CLI - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

What is the output of this ssh-keygen command?

You run the command ssh-keygen -t rsa -b 2048 -f mykey -N "" in a Linux terminal. What output will you see immediately after?

Linux CLI

ssh-keygen -t rsa -b 2048 -f mykey -N ""

A Error: Invalid option -b 2048

B ssh-keygen: command not found

C

Generating public/private rsa key pair.
Your identification has been saved in mykey.
Your public key has been saved in mykey.pub.
The key fingerprint is:
SHA256:... user@hostname
The key's randomart image is:
+---[RSA 2048]----+
| .o+o.           |
|.o=+o            |
|+o+o             |
|=+o              |
|.o.              |
|                 |
|                 |
|                 |
|                 |
+----[SHA256]-----+

D

Generating DSA key pair.
Your identification has been saved in mykey.
Your public key has been saved in mykey.pub.

💡 Hint

Think about what ssh-keygen outputs when generating an RSA key with no passphrase.

The command generates an RSA key pair with 2048 bits, saves it to 'mykey' and 'mykey.pub', and prints the fingerprint and randomart image. Option C matches this output exactly.

💻 Command Output

intermediate

What error does this ssh-keygen command produce?

You run ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N without specifying a passphrase value. What error message appears?

Linux CLI

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N

A Permission denied: cannot write to ~/.ssh/id_ed25519

B

Generating public/private ed25519 key pair.
Your identification has been saved in ~/.ssh/id_ed25519.

C Error: Unknown key type ed25519

D

ssh-keygen: option requires an argument -- 'N'
Usage: ssh-keygen [options]

💡 Hint

The -N option requires a passphrase argument, even if empty.

The -N option must be followed by a passphrase string. Omitting it causes an error about missing argument.

📝 Syntax

advanced

Which ssh-keygen command correctly generates a 4096-bit RSA key with a comment?

Select the command that generates a 4096-bit RSA key with the comment '[e-mail]' and saves it to 'admin_rsa'.

A ssh-keygen -t rsa -b 4096 -C [e-mail] -f admin_rsa

B ssh-keygen -t rsa -b 4096 -comment [e-mail] -file admin_rsa

C ssh-keygen --type rsa --bits 4096 --comment '[e-mail]' --file admin_rsa

D ssh-keygen -type rsa -bits 4096 -C '[e-mail]' -f admin_rsa

💡 Hint

Check the correct ssh-keygen option names for comment and file.

Option A uses the correct short options: -t for type, -b for bits, -C for comment, and -f for file. Other options use invalid or incorrect flags.

🚀 Application

advanced

How to automate ssh-keygen to generate a key without prompts?

You want to write a script that generates an ed25519 SSH key named 'deploy_key' with no passphrase and no user interaction. Which command achieves this?

A ssh-keygen -t ed25519 -f deploy_key

B ssh-keygen -t ed25519 -f deploy_key -N "" -q

C ssh-keygen -t ed25519 -f deploy_key -P ""

D ssh-keygen -t ed25519 -f deploy_key -n

💡 Hint

Use options to suppress prompts and specify empty passphrase.

Option B uses -N "" to set empty passphrase and -q to suppress output, so it runs without prompts. Others either prompt or use invalid options.

🧠 Conceptual

expert

What is the effect of the -o option in ssh-keygen?

You run ssh-keygen -t rsa -b 2048 -o -f keyfile. What does the -o option do?

A It saves the private key using the new OpenSSH format instead of the older PEM format.

B It overwrites the existing keyfile without asking for confirmation.

C It outputs the public key to standard output instead of a file.

D It optimizes the key generation speed by using fewer random bytes.

💡 Hint

Think about key file formats and security improvements.

The -o option tells ssh-keygen to save the private key in the new OpenSSH format, which is more secure than the older PEM format.

Practice

1. What is the primary purpose of the ssh-keygen command in Linux?

easy

A. To start an SSH server on the local machine

B. To generate a pair of cryptographic keys for SSH authentication

C. To connect to a remote server using SSH

D. To display the current SSH connections

Solution

1. Step 1: Understand the function of ssh-keygen

   The ssh-keygen command is used to create a pair of keys: a private key and a public key, which are used for secure SSH authentication.

2. Step 2: Differentiate from other SSH commands

   Starting an SSH server or connecting to a server uses different commands like sshd or ssh. Displaying connections is unrelated.

3. Final Answer:

   To generate a pair of cryptographic keys for SSH authentication -> Option B

4. Quick Check:

   ssh-keygen creates keys = B [OK]

Hint: ssh-keygen always creates keys, not connections or servers [OK]

Common Mistakes:

• Confusing ssh-keygen with ssh command
• Thinking ssh-keygen starts SSH server
• Assuming ssh-keygen shows active connections

2. Which of the following is the correct syntax to generate an RSA SSH key pair with ssh-keygen?

easy

A. ssh-keygen -t rsa

B. ssh-keygen -g rsa

C. ssh-keygen --generate rsa

D. ssh-keygen -type rsa

Solution

1. Step 1: Identify the correct option flag for key type

   The -t flag specifies the type of key to generate, such as rsa, dsa, or ed25519.

2. Step 2: Check the syntax correctness

   Only ssh-keygen -t rsa is valid syntax. Other options like -g, --generate, or -type are invalid or do not exist.

3. Final Answer:

   ssh-keygen -t rsa -> Option A

4. Quick Check:

   -t specifies type = D [OK]

Hint: Use -t to specify key type in ssh-keygen [OK]

Common Mistakes:

• Using -g instead of -t for key type
• Adding extra words like --generate
• Using -type instead of -t

3. What will be the output of the following command if the default key files already exist?

ssh-keygen -t ed25519

medium

A. It throws an error and exits immediately

B. It overwrites the existing key files without warning

C. It prompts to overwrite the existing files or choose a new name

D. It generates a new key with a random filename automatically

Solution

1. Step 1: Understand ssh-keygen behavior on existing files

   When key files already exist, ssh-keygen asks the user if they want to overwrite or specify a new filename.

2. Step 2: Confirm it does not overwrite silently or error out

   It does not overwrite without confirmation, nor does it throw an error or generate random filenames automatically.

3. Final Answer:

   It prompts to overwrite the existing files or choose a new name -> Option C

4. Quick Check:

   ssh-keygen asks before overwrite = A [OK]

Hint: ssh-keygen asks before overwriting existing keys [OK]

Common Mistakes:

• Assuming it overwrites files silently
• Expecting an error instead of prompt
• Thinking it auto-generates random filenames

4. You ran ssh-keygen -t rsa -b 4096 but got an error: unknown option: -b. What is the most likely cause?

medium

A. The command requires sudo privileges to use -b

B. The -b option is invalid for RSA keys

C. You must specify the key filename before the -b option

D. You used an outdated ssh-keygen version that does not support the -b option

Solution

1. Step 1: Understand the -b option usage

   The -b option sets the number of bits for the key size and is valid for RSA keys.

2. Step 2: Identify why the error occurs

   An unknown option error usually means the ssh-keygen version is old and does not recognize the -b flag.

3. Final Answer:

   You used an outdated ssh-keygen version that does not support the -b option -> Option D

4. Quick Check:

   Old ssh-keygen lacks -b support = A [OK]

Hint: Check ssh-keygen version if options cause unknown errors [OK]

Common Mistakes:

• Thinking -b is invalid for RSA
• Believing filename order matters for options
• Assuming sudo is needed for key size

5. You want to automate SSH key generation in a script without any prompts, saving the key as ~/.ssh/id_ed25519_custom. Which command correctly achieves this?

hard

A. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -N ''

B. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom

C. ssh-keygen -t ed25519 -N ''

D. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -y

Solution

1. Step 1: Understand flags for silent key generation

   The -f flag sets the filename, and -N '' sets an empty passphrase to avoid prompts.

2. Step 2: Check each option for automation suitability

   ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -N '' uses both -f and -N '' correctly. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom misses -N so it prompts for passphrase. ssh-keygen -t ed25519 -N '' misses filename, so default is used. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -y uses -y which outputs public key but does not generate keys silently.

3. Final Answer:

   ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -N '' -> Option A

4. Quick Check:

   Use -f for file and -N '' for no passphrase = C [OK]

Hint: Use -f for file and -N '' for no passphrase to avoid prompts [OK]

Common Mistakes:

• Omitting -N '' causes passphrase prompt
• Forgetting to specify filename with -f
• Using -y which only outputs public key