I have 2 systems that I use almost daily. One is desktop located within office premises and another one is laptop. Both are running Ubuntu LTS linux.
I know that SSH keys generated on one system can be copied to another system and it won't break anything like pushing/committing. But I don't want to do that. I need to track from which system I had push/committed the code.
To achieve that I have added 2 diff. emails to my GitHub account.
john+desktop#gmail.com
john+laptop#gmail.com
Now I need to generate diff. SSH keys on desktop and laptop, but I don't know how to do that.
A friend of mine suggested me to read this article. Step 2 shows following code
ssh-keygen -t rsa -b 4096 -C "your_email#example.com"
# Creates a new ssh key, using the provided email as a label
Generating public/private rsa key pair.
Above command has provision to pass email address, but it mentions email address as a label. I didn't understand label part of the command.
Should below commands solve my query?
ssh-keygen -t rsa -b 4096 -C "john+desktop#gmail.com"
ssh-keygen -t rsa -b 4096 -C "john+laptop#gmail.com"
According to the ssh-keygen manual the -C parameter is used to provide a comment.
-C comment
Provides a new comment.
This comment is useful to remember what the key is for. On github, setting the comment to the email helps you remember for which email account you are using that specific key.
Your commands will definitely solve your problem but also theese will do the trick
ssh-keygen -t rsa -b 4096 -C "github key number desktop"
ssh-keygen -t rsa -b 4096 -C "github key number laptop"
You can change the comment later by editing the pub file with any text editor.
Related
I've got a private Github repo I want to access from two different Linux machines using the same set of ssh keys
For the first machine, I followed Github's instructions for generating SSH keys, and added the resulting public key to Github. This client works fine.
i uplaoded both my private and public key in GitHub gists to easily wget it on second client
In the second machine , I downloaded the the private and public key to the necessary directory and gave relevant permissions.
wget -O /root/.ssh/id_rsa.pub URL(RAW)
wget -O /root/.ssh/id_rsa URL(RAW)
chmod 700 /root/.ssh
chmod 600 /root/.ssh/id_rsa
chmod 600 /root/.ssh/id_rsa.pub
I thought this might be all I had to do, but when I try to connect i get the following error
root#InstanceIDInHexa:~# ssh -T git#github.com
The authenticity of host 'github.com (xxx.xxx.xxx.xxx)' can't be established.
RSA key fingerprint is SHA256:RandomStringOfAlphaNumericCharacters.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'github.com,xxx.xxx.xxx.xxx' (RSA) to the list of known hosts.
Load key "/root/.ssh/id_rsa": invalid format
git#github.com: Permission denied (publickey).
root#InstanceIDInHexa:~#
I also checked the content and permissions of all the files and it looks good
cat /root/.ssh/id_rsa
cat /root/.ssh/id_rsa.pub
stat -c "%a" /root/.ssh
stat -c "%a" /root/.ssh/id_rsa
stat -c "%a" /root/.ssh/id_rsa.pub
is there something i am missing here ?
First of all, the best practice is to have one key per user per machine. That's the most secure approach, because it means you can remove access from one machine independent from the other, such as if one machine is lost or stolen.
However, having said that, if you really want to do this and want to ignore best practices, you can copy the id_rsa and id_rsa.pub files to a different machine, and that should work. However, in this case, you generated the key on a newer machine which uses a different private key format or a more modern encryption algorithm for encrypting it then the older machine. The default encryption for older RSA keys, the PKCS #1 format, tends to leave a lot to be desired and isn't very secure.
The easiest, simplest way to solve this problem is to generate a new Ed25519 key pair because those always use the OpenSSH format, and you can do that with ssh-keygen -t ed25519. If you want to then copy it, the files are ~/.ssh/id_ed25519 and ~/.ssh/id_ed25519.pub. This is also the most preferred key format these days, but if you're using something ancient like CentOS 6, then it may not be supported.
If you don't want to do that, then you can convert the existing private key using ssh-keygen -i and ssh-keygen -e to convert your private key to the appropriate format. This should be done on the newer machine, the one that generated the key. The manual page documents the options and formats supported. You can use file on that machine to find out the format that the private key is in.
How to know the SSH key's length?
I'm getting the following error for my git pull just recently,
$ git pull
> GitLab: Your SSH key must be at least 2048 bits.
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
where everything had been working fine before.
Instead of guessing (or trial-n-error) which key is the culprit, is it possible to list all my SSH keys' length?
UPDATE:
Only git pull is giving me above error. I.e., my public key is still fine:
$ ssh -T git#salsa.debian.org
Welcome to GitLab, #myid-guest!
The ssh-keygen -lf might not be the answer, as I'm following https://docs.gitlab.com/ee/ssh/, who recommends to use ed25519 as default key, and who also instructs that, to generate a new ED25519 SSH key pair, do ssh-keygen -t ed25519 -C "email#example.com". However, my ssh-keygen -lf reports that
$ ssh-keygen -lf id_ed25519.pub
256 SHA256:PO2bk6B...
It is unlikely that the recommend ED25519 SSH key is only 256 bits long.

Can you try
ssh-keygen -lf keygen.pub
You might have accidentally deleted the public key that Gitlab uses to authenticate you.
I would recommend contacting them, otherwise look up into it.
I've created a server on Digital Ocean and made a keypair for connection over ssh for the root user. Now it wants me to create a keypair for the new regular user I've created. What is the normal practice for naming these keys and how do I use them so the system knows which keys to use when I'm signing in to each account?
Name them however you wish to remember them; typically by user. Use the identify file option when you connect.
To connect with a file:
ssh -i /path/to/key.pem user#host
To generate a new file and save it somewhere
ssh-keygen -f /path/to/file
See man ssh && man ssh-keygen
See: https://www.freebsd.org/cgi/man.cgi?query=ssh&sektion=1
See: https://linux.die.net/man/1/ssh-keygen
This is my code:
ssh-keygen -t rsa -C "$APP"
This works perfectly. However it then asks me to specify location and password. I was hoping I can automate this all in one go, however this command fails:
ssh-keygen -t rsa -C "$APP" -P "$SSHKEYPASS" -T ~/.ssh/id_rsa.pub
This command seems to fail though, when I specify the password I want for the key and location in the same line. I don't really understand the man page:
http://linux.die.net/man/1/ssh-keygen
Can anyone tell me where I have gone wrong?
-P is for the old passphrase, to create a key I assume you want -N for the new passphrase.
-T is for DH group test output it appears (not that I know what that is exactly).
You want -f to specify the key filename. And you specify the private key file not the public key file.
So try:
ssh-keygen -t rsa -C "$APP" -N "$SSHKEYPASS" -f ~/.ssh/id_rsa
I just installed ubuntu and would like to set its rsa keys up with bitbucket/github. When I ssh-keygen the keys are generated as they should be
ssh-rsa AA...yBEz3pLL georgemauer#ubuntu
which is perfectly usable except the username part. In every rsa key I've generated previously, the username section read my email address:
ssh-rsa AA...yBEz3pLL gmylastname#gmail.com
No, it's not a major impediment but if I don't get this right it will drive me crazy. How, do I generate with rsa keys with an email username of my choice?
Use the -C option to provide a new comment with your key.
Explanation: In general, the last string in your ssh public key would be a single comment which in default configured to your user#host. You can override this comment by adding -C argument and edit this string.
For example In default behaviour, lets say that - if your linux hostname is Ubuntu and your user name is john.doe while you watch your public key performing cat ~/.ssh/id_rsa.pub you would see something like this:
ssh-rsa <someReallyBigToken>== john.doe#ubuntu
Documentation:
ssh-keygen will by default write keys in an OpenSSH-specific format.
This format is preferred as it offers better protection for keys at
rest as well as allowing storage of key
comments within the private key file itself. The key comment may be useful to help identify the key. The comment is initialized to
``user#host'' when the key is created, but
can be changed using the -c option.
Solution: override this comment and use -C argument for comment.
ssh-keygen -t rsa -b 4096 -C message-in-a-bottle
cat ~/.ssh/id_rsa.pub
// output:
ssh-rsa <someReallyBigToken>== message-in-a-bottle
ssh-keygen -t rsa -f ~/.ssh/[KEY_FILENAME] -C [USERNAME]
I use this command for generating the SSH key for generating GitHub, GitLab, and GCP.
Here is the documentation for creating an SSH key with a username.