ssh-keygenCreate and manage SSH keys
ssh-keygen creates the key pairs used to log in to servers and Git hosts without passwords, shows key fingerprints, changes passphrases and cleans stale host keys out of known_hosts. Ed25519 keys are the modern default: short, fast and secure.
ssh-keygen [-t ed25519|rsa|ecdsa] [-b BITS] [-C COMMENT] [-f FILE] [-N PASSPHRASE] | -l -f FILE | -y -f FILE | -p -f FILE | -R HOSTYou need a key to log in to servers and push to Git without typing passwords.
ssh-keygenThe OpenSSH key tool: generates, inspects and converts keys.
ssh-keygen generates a key pair with OpenSSL or OpenSSH's own crypto: for Ed25519, 32 random bytes from the kernel's random generator become the private key and the public key is derived from them. The private key is written in OpenSSH's format (-----BEGIN OPENSSH PRIVATE KEY-----) with mode 600; if you give a passphrase it is encrypted with AES-256 using a key derived from the passphrase by bcrypt with -a rounds. The public key is one line: type, base64 key blob, comment. That line is what goes into a server's ~/.ssh/authorized_keys or a Git host. During login the server never sees the private key: the client signs data from the session and the server checks the signature with the public key. A fingerprint is a SHA-256 hash of the public key blob, used to compare keys quickly. The same tool manages host keys (ssh-keygen -A creates missing /etc/ssh/ssh_host_* keys) and known_hosts entries (-F to find, -R to remove).
-t TYPEKey type: ed25519 (default choice), rsa, ecdsa, or ed25519-sk for hardware keys-b BITSKey size for RSA (use 4096); ignored for Ed25519-C COMMENTComment at the end of the public key (who/where)-f FILEOutput file (private key); .pub is added for the public key-N PASSPassphrase on the command line ("" for none, e.g. CI deploy keys)-a ROUNDSKDF rounds protecting the passphrase (default 16)-l -f FILEShow a key's fingerprint (-E md5 for the old format)-y -f FILEPrint the public key derived from a private key-p -f FILEChange or add a passphrase without changing the key-R HOSTRemove a host's entries from known_hosts-F HOSTFind a host in known_hosts (works with hashed entries)-qQuiet: no randomart, for scriptsssh-keygen -t rsa -b 1024 (or a default 2048-bit RSA key copied from an old guide)Short RSA keys are weak, and some modern servers reject ssh-rsa signatures with SHA-1 altogether.
ssh-keygen -t ed25519 (or -t rsa -b 4096 where Ed25519 isn't supported)Sharing one private key between people or between laptops and CIYou can't tell who logged in, and revoking access for one person means rotating the key everywhere.
One key per person per device, one deploy key per pipelinePasting the private key (id_ed25519) into authorized_keys or a Git hostOnly the .pub belongs there. Anyone who sees the private key can impersonate you.
cat ~/.ssh/id_ed25519.pub, or ssh-copy-idAnswering 'yes' to the overwrite prompt when ssh-keygen says the key already existsYour old private key is replaced; every server that only knew the old public key now locks you out.
Use -f to write the new key to a different fileTry these on a Linux machine of your own. Each task has a hint and a solution.
Create an Ed25519 key at ~/.ssh/lab_key with the comment devops@lab and no passphrase.
Show the fingerprint of that key, then rebuild its public key from the private key and compare.
Add a passphrase to ~/.ssh/lab_key without changing the key itself, and confirm the fingerprint is unchanged.
Make the private key readable by everyone, observe what ssh-keygen -y says, then fix the permissions.
ssh-keygenCreate and manage SSH keys
ssh-keygen creates the key pairs used to log in to servers and Git hosts without passwords, shows key fingerprints, changes passphrases and cleans stale host keys out of known_hosts. Ed25519 keys are the modern default: short, fast and secure.
ssh-keygen [-t ed25519|rsa|ecdsa] [-b BITS] [-C COMMENT] [-f FILE] [-N PASSPHRASE] | -l -f FILE | -y -f FILE | -p -f FILE | -R HOSTYou need a key to log in to servers and push to Git without typing passwords.
ssh-keygenThe OpenSSH key tool: generates, inspects and converts keys.
ssh-keygen generates a key pair with OpenSSL or OpenSSH's own crypto: for Ed25519, 32 random bytes from the kernel's random generator become the private key and the public key is derived from them. The private key is written in OpenSSH's format (-----BEGIN OPENSSH PRIVATE KEY-----) with mode 600; if you give a passphrase it is encrypted with AES-256 using a key derived from the passphrase by bcrypt with -a rounds. The public key is one line: type, base64 key blob, comment. That line is what goes into a server's ~/.ssh/authorized_keys or a Git host. During login the server never sees the private key: the client signs data from the session and the server checks the signature with the public key. A fingerprint is a SHA-256 hash of the public key blob, used to compare keys quickly. The same tool manages host keys (ssh-keygen -A creates missing /etc/ssh/ssh_host_* keys) and known_hosts entries (-F to find, -R to remove).
-t TYPEKey type: ed25519 (default choice), rsa, ecdsa, or ed25519-sk for hardware keys-b BITSKey size for RSA (use 4096); ignored for Ed25519-C COMMENTComment at the end of the public key (who/where)-f FILEOutput file (private key); .pub is added for the public key-N PASSPassphrase on the command line ("" for none, e.g. CI deploy keys)-a ROUNDSKDF rounds protecting the passphrase (default 16)-l -f FILEShow a key's fingerprint (-E md5 for the old format)-y -f FILEPrint the public key derived from a private key-p -f FILEChange or add a passphrase without changing the key-R HOSTRemove a host's entries from known_hosts-F HOSTFind a host in known_hosts (works with hashed entries)-qQuiet: no randomart, for scriptsssh-keygen -t rsa -b 1024 (or a default 2048-bit RSA key copied from an old guide)Short RSA keys are weak, and some modern servers reject ssh-rsa signatures with SHA-1 altogether.
ssh-keygen -t ed25519 (or -t rsa -b 4096 where Ed25519 isn't supported)Sharing one private key between people or between laptops and CIYou can't tell who logged in, and revoking access for one person means rotating the key everywhere.
One key per person per device, one deploy key per pipelinePasting the private key (id_ed25519) into authorized_keys or a Git hostOnly the .pub belongs there. Anyone who sees the private key can impersonate you.
cat ~/.ssh/id_ed25519.pub, or ssh-copy-idAnswering 'yes' to the overwrite prompt when ssh-keygen says the key already existsYour old private key is replaced; every server that only knew the old public key now locks you out.
Use -f to write the new key to a different fileTry these on a Linux machine of your own. Each task has a hint and a solution.
Create an Ed25519 key at ~/.ssh/lab_key with the comment devops@lab and no passphrase.
Show the fingerprint of that key, then rebuild its public key from the private key and compare.
Add a passphrase to ~/.ssh/lab_key without changing the key itself, and confirm the fingerprint is unchanged.
Make the private key readable by everyone, observe what ssh-keygen -y says, then fix the permissions.