ssh-keygen — key generation and management

💬 "ssh-keygen command"

ssh-keygen creates a private/public key pair. Place the public key on the server to connect without a password.

Recently, the short and secure ed25519 type is recommended.

• Concept: Generates and inspects key pairs for authentication.
• Private key: id_ed25519 — never share it.
• Public key: id_ed25519.pub — the value placed in the server's authorized_keys.
• Fingerprint: Use -l -f to check the key fingerprint.

Commonly used options

Three essential command combinations

• ssh-keygen -t ed25519 -C 'deploy@ci' -f ~/.ssh/deploy_ed25519 — Generate a deployment key
• ssh-keygen -l -f ~/.ssh/deploy_ed25519.pub — Check the public key fingerprint
• ssh-copy-id -i ~/.ssh/deploy_ed25519.pub deploy@10.0.0.9 — Register the public key on the server

💬 "Show me a useful example for checking right after deployment"

This is a step-by-step rundown of situations commonly encountered on live servers.

Step 1 · Key generation

Create it with a filename that indicates its purpose.

ssh-keygen -t ed25519 -C 'deploy@ci' -f ~/.ssh/deploy_ed25519

Step 2 · Public key registration

Add it to the target server's authorized_keys.

ssh-copy-id -i ~/.ssh/deploy_ed25519.pub deploy@10.0.0.9

Step 3 · Connection verification

Check that you can connect without a password.

ssh -i ~/.ssh/deploy_ed25519 deploy@10.0.0.9 'echo OK'

How it is used in practice

1. Issuing a CI deployment key

Situation — A CI pipeline needs a dedicated key to deploy to servers.

ssh-keygen -t ed25519 -C 'ci-deploy' -f ~/.ssh/ci_deploy -N ''

Result — A passwordless key is generated and can be used immediately by CI.

Point — Separate CI keys by purpose and manage them so they can be replaced immediately if leaked.

2. Checking a key fingerprint

Situation — You need to verify that the key registered on the server is correct.

ssh-keygen -l -f ~/.ssh/id_ed25519.pub

Result — The SHA256 fingerprint is printed so you can compare it with the server's authorized_keys.

Point — Fingerprint comparison is a basic procedure in key rotation and audits.

Things to keep in mind

• Never share or commit private keys externally.
• Passwordless keys are convenient but risky if leaked. Use them only in isolated environments like CI.
• Key file permissions must be 600, and the .ssh directory must be 700.
• Overwriting an existing key can break access, so specify the -f path carefully.

Actual execution screen

This is the result of generating an ed25519 deployment key.

!ssh-keygen command execution result: key generation and fingerprint

A real production server

Source (HTML): https://games.aidebatehub.com/programs/linux/remote/ssh-keygen.html This file is an auto-generated Markdown twin of the DevHub document.