The Ultimate Guide to SSH – Setting Up SSH Keys

SSH, or Secure Shell, is a widely used protocol for securely accessing remote servers and devices over an untrusted network. One of the key features of SSH is its support for public key cryptography, which allows you to authenticate to a remote system without entering a password. In this ultimate guide, we‘ll dive deep into setting up SSH keys, from generating your first key pair to advanced management of multiple identities.

What are SSH Keys?

An SSH key is actually a pair of keys – a public key and a private key – that are cryptographically linked. The public key, as its name suggests, can be shared freely without compromising security. It‘s placed on the remote servers you want to access. The private key is kept secret on your local machine.

When you attempt to connect to a server using SSH, the server will ask your SSH client to prove its identity. Your SSH client will use your private key to digitally sign a challenge sent by the server. The server then verifies the signature using your public key. If the signature is valid, it means you possess the corresponding private key, and you are granted access without needing a password.

This key-based authentication is not only more secure than passwords, which can be guessed or bruteforced, but also very convenient. You can connect to a server with a single command, without interactively entering credentials.

Generating an SSH Key Pair

The first step in using SSH keys is generating a key pair on your local machine. Open a terminal and enter the following command:

ssh-keygen -t rsa -b 4096

This instructs the ssh-keygen utility to generate a new key pair using the RSA algorithm with a key size of 4096 bits.

You‘ll be prompted to enter a file path to save the key. Press Enter to accept the default location, which is ~/.ssh/id_rsa:

Generating public/private rsa key pair.
Enter file in which to save the key (/home/username/.ssh/id_rsa):

Next, you‘ll be asked to enter a passphrase for the key:

Enter passphrase (empty for no passphrase):

While it‘s possible to leave the passphrase empty, it‘s highly recommended to set one. A passphrase encrypts the private key, providing an additional layer of security. Even if someone manages to get their hands on your private key file, they won‘t be able to use it without knowing the passphrase.

After confirming your passphrase, the key generation is complete:

Your identification has been saved in /home/username/.ssh/id_rsa
Your public key has been saved in /home/username/.ssh/id_rsa.pub
The key fingerprint is:
SHA256:tYqi/Ixo9Hgh5zlks+SD5tKxaDeyZzbOVYerl8jL0lg username@hostname

You now have two files in your ~/.ssh directory:

• id_rsa: This is your private key. Guard it like a secret.
• id_rsa.pub: This is your public key, which can be shared freely.

Installing Your Public Key on a Remote Server

To use your newly generated SSH key to authenticate to a remote server, you need to install your public key on that server. The exact process depends on your server setup, but typically involves adding the contents of your id_rsa.pub file to a special file on the server called authorized_keys.

Many hosting services and cloud providers offer web interfaces and APIs for installing SSH keys. For example, to add a key on GitHub for accessing repositories, you would go to Settings > SSH and GPG keys and click "New SSH key".

For servers you manage yourself, you can install your public key using the ssh-copy-id command:

ssh-copy-id username@remote_host

This will copy your public key to the server and place it in the appropriate authorized_keys file.

If ssh-copy-id is not available, you can manually copy the key:

cat ~/.ssh/id_rsa.pub | ssh username@remote_host "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

After installing your public key, try logging into the server:

ssh username@remote_host

If everything is set up correctly, you should be logged in without being asked for a password.

Managing Multiple SSH Keys

It‘s common to use different SSH keys for different servers or accounts. For example, you might have one key pair for your personal projects on GitHub, and another for your work repositories on GitLab.

To generate additional key pairs, run ssh-keygen again, but this time specify a different filename:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_work

This will create a new key pair with the files ~/.ssh/id_rsa_work and ~/.ssh/id_rsa_work.pub.

To use these keys, you need to inform your SSH client about them. The easiest way is to create or edit the ~/.ssh/config file. Here‘s an example configuration:

Host github.com
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_rsa

Host gitlab.work.com
    HostName gitlab.work.com  
    User git
    IdentityFile ~/.ssh/id_rsa_work

With this setup, SSH will automatically use the ~/.ssh/id_rsa key when connecting to github.com, and the ~/.ssh/id_rsa_work key when connecting to gitlab.work.com.

Using SSH Agent

If you set passphrases for your keys (as you should!), you‘d normally have to enter the passphrase each time you use the key. This can get tedious, especially if you connect to servers frequently.

The solution is to use ssh-agent, a helper program that runs in the background and caches decrypted private keys in memory. When an SSH client needs a key, it will ask ssh-agent, which will provide the key without prompting for the passphrase again.

To start using ssh-agent, run:

eval "$(ssh-agent -s)"

Then add your private keys to the agent:

ssh-add ~/.ssh/id_rsa
ssh-add ~/.ssh/id_rsa_work

You‘ll be prompted to enter the passphrases for the keys. Afterward, you can connect to servers without re-entering passphrases.

To have ssh-agent automatically start and load your keys on login, you can add the above commands to your ~/.bashrc or ~/.zshrc file.

Troubleshooting SSH Key Issues

If you‘re having trouble connecting to a server with SSH keys, here are a few things to check:

1. Make sure your public key is installed correctly on the server in the authorized_keys file. The file should contain the contents of your id_rsa.pub file on a single line.

2. Check the permissions on the .ssh directory and authorized_keys file on the server. The .ssh directory should have 700 permissions, and authorized_keys should have 600 permissions.

3. If you‘re using a custom key path, make sure it‘s specified correctly in your ~/.ssh/config file or in the ssh command with the -i flag.

4. If you‘re being asked for a passphrase unexpectedly, your key may not be loaded into ssh-agent. Run ssh-add to add it.

5. If all else fails, run ssh with the -v flag to enable verbose output, which can help diagnose the problem.

ssh -v username@remote_host

With this knowledge in hand, you‘re well-equipped to start using SSH keys for secure, password-free authentication. While the setup process may seem involved at first, the security and convenience are well worth it in the long run. Happy SSH-ing!