SSH key generation (ssh-keygen) in Linux CLI - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of the ssh-keygen command?

The ssh-keygen command creates a pair of keys (a public key and a private key) used to securely connect to remote computers without using passwords.

beginner

What files are created by default when you run ssh-keygen without options?

By default, ssh-keygen creates two files in your ~/.ssh/ folder: id_rsa (private key) and id_rsa.pub (public key).

beginner

Why should you keep your private key safe and never share it?

The private key is like a secret password. If someone else gets it, they can access your remote computers as if they were you. Only share the public key.

beginner

How do you add a passphrase to your SSH key during generation?

When running ssh-keygen, it asks for a passphrase. You can type a secret phrase to add extra protection to your private key.

intermediate

What is the command to generate an SSH key with RSA algorithm and 4096 bits key size?

Use ssh-keygen -t rsa -b 4096 to create a strong RSA key with 4096 bits length.

What does the ssh-keygen command generate?

A A configuration file for SSH

B A password for SSH login

C A new SSH server

D A pair of public and private keys

ssh-keygen creates a pair of keys used for secure SSH authentication.

Where are SSH keys stored by default after running ssh-keygen?

A /usr/bin/

B /etc/ssh/

C ~/.ssh/

D /var/log/

SSH keys are saved in the ~/.ssh/ directory in your home folder.

Which file contains the public key after generating SSH keys?

A id_rsa.pub

B id_rsa

C authorized_keys

D config

The public key is saved in the file ending with .pub, usually id_rsa.pub.

What is the benefit of adding a passphrase to your SSH key?

A Automatically uploads the key to servers

B Adds extra security by encrypting the private key

C Allows multiple users to share the key

D Makes the key generation faster

A passphrase encrypts your private key, so even if stolen, it cannot be used without the passphrase.

How do you specify the key type and size when generating an SSH key?

A ssh-keygen -t rsa -b 4096

B ssh-keygen --type rsa --size 2048

C ssh-keygen -key rsa -size 1024

D ssh-keygen -generate rsa 4096

The correct syntax is ssh-keygen -t rsa -b 4096 to specify RSA type and 4096 bits.

Explain the process and purpose of generating SSH keys using ssh-keygen.

Think about how you can log in to a remote computer safely without typing a password every time.

Describe how to generate a strong SSH key with a passphrase and where the keys are stored.

Remember the command syntax and the default folder for SSH keys.

Practice

1. What is the primary purpose of the ssh-keygen command in Linux?

easy

A. To start an SSH server on the local machine

B. To generate a pair of cryptographic keys for SSH authentication

C. To connect to a remote server using SSH

D. To display the current SSH connections

Solution

1. Step 1: Understand the function of ssh-keygen

   The ssh-keygen command is used to create a pair of keys: a private key and a public key, which are used for secure SSH authentication.

2. Step 2: Differentiate from other SSH commands

   Starting an SSH server or connecting to a server uses different commands like sshd or ssh. Displaying connections is unrelated.

3. Final Answer:

   To generate a pair of cryptographic keys for SSH authentication -> Option B

4. Quick Check:

   ssh-keygen creates keys = B [OK]

Hint: ssh-keygen always creates keys, not connections or servers [OK]

Common Mistakes:

• Confusing ssh-keygen with ssh command
• Thinking ssh-keygen starts SSH server
• Assuming ssh-keygen shows active connections

2. Which of the following is the correct syntax to generate an RSA SSH key pair with ssh-keygen?

easy

A. ssh-keygen -t rsa

B. ssh-keygen -g rsa

C. ssh-keygen --generate rsa

D. ssh-keygen -type rsa

Solution

1. Step 1: Identify the correct option flag for key type

   The -t flag specifies the type of key to generate, such as rsa, dsa, or ed25519.

2. Step 2: Check the syntax correctness

   Only ssh-keygen -t rsa is valid syntax. Other options like -g, --generate, or -type are invalid or do not exist.

3. Final Answer:

   ssh-keygen -t rsa -> Option A

4. Quick Check:

   -t specifies type = D [OK]

Hint: Use -t to specify key type in ssh-keygen [OK]

Common Mistakes:

• Using -g instead of -t for key type
• Adding extra words like --generate
• Using -type instead of -t

3. What will be the output of the following command if the default key files already exist?

ssh-keygen -t ed25519

medium

A. It throws an error and exits immediately

B. It overwrites the existing key files without warning

C. It prompts to overwrite the existing files or choose a new name

D. It generates a new key with a random filename automatically

Solution

1. Step 1: Understand ssh-keygen behavior on existing files

   When key files already exist, ssh-keygen asks the user if they want to overwrite or specify a new filename.

2. Step 2: Confirm it does not overwrite silently or error out

   It does not overwrite without confirmation, nor does it throw an error or generate random filenames automatically.

3. Final Answer:

   It prompts to overwrite the existing files or choose a new name -> Option C

4. Quick Check:

   ssh-keygen asks before overwrite = A [OK]

Hint: ssh-keygen asks before overwriting existing keys [OK]

Common Mistakes:

• Assuming it overwrites files silently
• Expecting an error instead of prompt
• Thinking it auto-generates random filenames

4. You ran ssh-keygen -t rsa -b 4096 but got an error: unknown option: -b. What is the most likely cause?

medium

A. The command requires sudo privileges to use -b

B. The -b option is invalid for RSA keys

C. You must specify the key filename before the -b option

D. You used an outdated ssh-keygen version that does not support the -b option

Solution

1. Step 1: Understand the -b option usage

   The -b option sets the number of bits for the key size and is valid for RSA keys.

2. Step 2: Identify why the error occurs

   An unknown option error usually means the ssh-keygen version is old and does not recognize the -b flag.

3. Final Answer:

   You used an outdated ssh-keygen version that does not support the -b option -> Option D

4. Quick Check:

   Old ssh-keygen lacks -b support = A [OK]

Hint: Check ssh-keygen version if options cause unknown errors [OK]

Common Mistakes:

• Thinking -b is invalid for RSA
• Believing filename order matters for options
• Assuming sudo is needed for key size

5. You want to automate SSH key generation in a script without any prompts, saving the key as ~/.ssh/id_ed25519_custom. Which command correctly achieves this?

hard

A. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -N ''

B. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom

C. ssh-keygen -t ed25519 -N ''

D. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -y

Solution

1. Step 1: Understand flags for silent key generation

   The -f flag sets the filename, and -N '' sets an empty passphrase to avoid prompts.

2. Step 2: Check each option for automation suitability

   ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -N '' uses both -f and -N '' correctly. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom misses -N so it prompts for passphrase. ssh-keygen -t ed25519 -N '' misses filename, so default is used. ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -y uses -y which outputs public key but does not generate keys silently.

3. Final Answer:

   ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_custom -N '' -> Option A

4. Quick Check:

   Use -f for file and -N '' for no passphrase = C [OK]

Hint: Use -f for file and -N '' for no passphrase to avoid prompts [OK]

Common Mistakes:

• Omitting -N '' causes passphrase prompt
• Forgetting to specify filename with -f
• Using -y which only outputs public key