{"id":56170,"date":"2025-01-15T12:45:00","date_gmt":"2025-01-15T17:45:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=56170"},"modified":"2025-01-28T15:16:46","modified_gmt":"2025-01-28T20:16:46","slug":"how-to-manage-ssh-keys-linux","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/how-to-manage-ssh-keys-linux","title":{"rendered":"How to Generate and Manage Linux SSH Keys"},"content":{"rendered":"\n
Jump to Tutorial<\/a><\/p>\n\n\n\n Secure Shell, or Secure Socket Shell \u2014 commonly abbreviated as SSH \u2014 is a secure network protocol that allows users to securely authenticate to remote devices. SSH leverages a pair of SSH keys<\/a> to encrypt communication with a remote system. The key pair is cryptographic in nature and made up of a public<\/em> and private<\/em> key. The keys work in tandem to provide authentication between the client and the remote system. <\/p>\n\n\n\n SSH keys grant users access to critical systems such as cloud and on-premise servers and network devices. Typically, these are systems that should only be accessed by authorized users, and no one else. Proper management of these keys is therefore essential to ensure that the SSH keys are in the right hands and used in accordance with the best security practices.<\/p>\n\n\n\n Before we proceed further, let us draw a distinction between public and private keys.<\/p>\n\n\n\n As the name suggests, the private key is only meant for the person who created it, and therefore strictly resides on the client system. It allows users to securely authenticate with the remote server, and should always be kept secret and never disclosed to anyone. In the wrong hands, the private key could be compromised and malicious users can use it to breach your systems. We cannot emphasize this enough: the private key should never<\/em> be revealed to anyone else.<\/p>\n\n\n\n On the other hand, the public key can be freely shared with any server you wish to connect to without compromising your identity. It is used for encrypting data exchanged between the server and the client. The private key decrypts the messages sent from the remote server and a connection is established. On the remote system, the public key is saved in the authorized_keys<\/kbd> Let\u2019s now switch gears and check out how SSH authentication works. <\/p>\n\n\n\n SSH authentication is broadly categorized into two types: password-based and public key authentication.<\/p>\n\n\n\n In password-based authentication, the client sends an authentication request to the server which includes the encrypted username and password for the remote server. Upon receipt, the server decrypts the request and validates the credentials in plain text. Once verified, the client is notified of the authentication outcome.<\/p>\n\n\n\n Public key authentication \u2014 also known as asymmetric encryption \u2014 uses a cryptographic key pair which comprises a private and public key on the client system. After generating the SSH key pair, both the public and private keys are saved on the client. The client then copies the public key to the remote server. <\/p>\n\n\n\n So, how does the authentication really work?\u00a0<\/p>\n\n\n\n During authentication, the client system sends an authentication request to the remote server which includes a public key. The remote server then receives the request and checks if the public key matches the one copied to it. If the key is valid and matches the one on the server, the server then creates a secret message and encrypts it with the public key from the client. The message is then sent back to the client whereupon the private key decrypts the message. Because this is asymmetric encryption, only the client system can decrypt the message with the private key. Once the message is decrypted, the server acknowledges it and the authentication is successful.<\/p>\n\n\n\n Public key authentication is the more preferred authentication of the two. It is more convenient and secure than password-based authentication \u2014 and for good reasons. SSH keys are complex and difficult to crack thanks to the strong encryption algorithms used. In addition, only the user with the private key can access the remote system. <\/p>\n\n\n\n When public key authentication is enabled, password authentication should be turned off so that only the private key alone can be used to authenticate with the remote system.<\/p>\n\n\n\n To leverage public key authentication, the first step is to generate the SSH key pair. To do so, launch your terminal on the client and run the following command:<\/p>\n\n\n\n The -t<\/kbd> flag specifies the type of the SSH key to be created. In this case, the RSA key pair. <\/p>\n\n\n\n There are two possible values of RSA: \u201crsa1<\/kbd>\u201d for RSA version 1 and \u201crsa<\/kbd>\u201d for RSA version 2. Since the first option is now deprecated and considered weak, here we are going with the latter which is considerably stronger.<\/p>\n\n\n\n Specify the location that you wish to save the key pair. Typically, the default path is the user\u2019s home directory or simply the Next, you will be required to provide a passphrase (optional). This adds an extra layer of security in the rare event that a hacker gets a hold of the key. You can leave it blank or specify a key phrase that will be required on each login attempt. To leave it blank, just hit \u201cENTER.\u201d<\/p>\n\n\n\n To confirm the keypair has been successfully generated, list the contents of the ~\/.ssh<\/kbd> The id_rsa<\/kbd> The id_rsa.pub<\/kbd> Once the SSH keys are generated, the next step is to copy the public key to the remote server. You can achieve this using the simple ssh-copy-id<\/kbd> Provide the remote server\u2019s password and hit \u201cENTER\u201d to copy the public key. You should get an acknowledgment from the remote server that the key was successfully added. The public key is saved to the ~\/.ssh\/authorized_keys<\/kbd> The next time you attempt to log in, the SSH-key challenge response will take place and you will be automatically logged in without password authentication. This is what is popularly known as SSH passwordless authentication since authentication is fully reliant on the SSH-key pair.<\/p>\n\n\n\n Permission denied errors are one of the most common issues encountered when using SSH keys. These errors typically indicate a problem with file permissions or misconfigurations in the authorized_keys<\/kbd> file. Common causes and solutions entail:<\/strong><\/p>\n\n\n\n The ssh-agent<\/kbd> is essential for managing SSH keys in memory during a session. If it is not running, you may encounter repeated prompts for your SSH key passphrase or failure to connect.<\/p>\n\n\n\n How to Start and Add Keys Again:<\/strong><\/p>\n\n\n\n The ~\/.ssh\/config<\/kbd> file can simplify the use of multiple SSH keys but must be configured correctly to avoid connection issues.<\/p>\n\n\n\n How to Validate and Correct Config Files:<\/strong><\/p>\n\n\n\n Given how critical SSH keys are in granting access to highly sensitive and mission-critical systems, having full visibility of your keys is essential to ensure they are in the right hands. Lack of proper SSH management can leave the organization susceptible to insider attacks orchestrated by disgruntled employees, or even external attacks where hackers steal the SSH keys and have a foothold of your resources. It could also lead to non-compliance by industry regulations such as PCI DSS and HIPAA.<\/p>\n\n\n\n We will take a high-level approach to the best practices you can implement to effectively manage your organization\u2019s SSH keys and protect valuable business assets.<\/p>\n\n\n\n The initial step in proper management of SSH keys is to take an inventory of the existing keys in your network and consolidate them in a central database. Doing this manually is a daunting and time-consuming task which is often prone to errors. An SSH manager helps you to automatically discover SSH keys within your IT environment and determine which systems they have access to. <\/p>\n\n\n\n Automation alleviates the cumbersome task of manually combing through each system in search of the keys. Further, a key manager helps identify orphaned SSH or idle SSH keys. Orphaned keys are public keys whose private keys\u2019 whereabouts are unknown. <\/p>\n\n\n\n Ideally, you do not need to add on another point solution to your already complex IT environment in order to automate SSH key management. A good cloud directory platform<\/a> can be leveraged instead to gain visibility and control of who has access to what IT resource, no matter where they exist. <\/p>\n\n\n\n The concept of least privilege in this case implies that only authorized users should be granted access to SSH keys. <\/p>\n\n\n\n To enforce this, you need to generate keys and associate them with the authorized users\u2019 accounts. In addition, best practices also recommends the removal of old keys every time an employee exits your organization, which leads us to the next point.<\/p>\n\n\n\n Unaudited keys including forgotten, idle, and orphaned keys can be used as backdoors by hackers or disgruntled employees to gain access and sabotage your IT resources. As a systems administrator, this is something you clearly don\u2019t want to risk.<\/p>\n\n\n\n It\u2019s prudent, therefore, to implement policies that ensure SSH keys associated with employees who have off-boarded are purged \u2014 much the same way you would disable email accounts of employees leaving the company. Otherwise, you will have old and orphaned keys lying around that can be exploited by unauthorized parties for nefarious reasons.<\/p>\n\n\n\n The best SSH key lifecycle automation tool<\/a> will be tied directly to a comprehensive identity and access management solution. This allows IT admins to securely manage users, systems, and access privileges from a single place, and automate employee offboarding with ease. <\/p>\n\n\n\n Good SSH key management demands that you have unique SSH keys for specific users and IT environments or servers. <\/p>\n\n\n\n For example, SSH keys assigned to IT administrators with access to production servers should be different from those assigned to developers who should only have access to the staging server. It\u2019s not hard to imagine what the outcome could be if a malicious user accessed the SSH keys of a user in one environment who also happens to use the same keys to access several other IT systems.<\/p>\n\n\n\n As your IT team grows over time and different members take on different projects, constant changes in access privileges become the norm. These constant changes can present vulnerabilities to your infrastructure when users access keys that should be a reserve for other users or left behind by off-boarded users.<\/p>\n\n\n\n To minimize such risk, it’s always recommended to periodically rotate SSH keys. The cycle of rotation may vary from one organization to another and according to your organization\u2019s audit policies. During SSH key rotation, new keys are generated to replace the old ones. Along the way, idle keys are also purged. By doing so, the chances of your systems being compromised are minimized to the lowest possible margin.<\/p>\n\n\n\n Your SSH key management strategy<\/a> is only as effective as the policies you have put in place to ensure the safety of the SSH keys and that they are in the right hands. Policies that merely appear on paper count for nothing. It behooves you, as the system administrator, to enforce strict policies that govern the usage of SSH keys and ensure accountability by those handling them. <\/p>\n\n\n\n Formulate policies that outline everyone\u2019s roles and how the keys will be used \u2014 or shared \u2014 and secured while in their possession. Most importantly, ensure that the policies are followed and enforced.<\/p>\n\n\n\n Using alternative SSH key types can enhance security and compatibility. Common key types include:<\/p>\n\n\n\n Restricting key usage adds an additional layer of security by limiting the actions a key can perform on the server.<\/p>\n\n\n\n Configuration Options in authorized_keys<\/kbd>:<\/strong><\/p>\n\n\n\n Applying Restrictions<\/strong>:<\/p>\n\n\n\n These restrictions help mitigate risks by ensuring that keys are only used for their intended purposes.<\/p>\n\n\n\n SSH keys provide a more secure and convenient way of authenticating to remote systems compared to the traditional username\/password authentication approach. However, for this authentication to continue to provide secure access to your resources, stringent management of the SSH keys is required, along with sound policies that ensure proper visibility of all the keys, what authorization each key has, and who gets to use which keys. <\/p>\n\n\n\n SSH key management has historically been challenging, due to the sheer number of SSH keys and the types of access many organizations must manage. Fortunately, hassle-free SSH key management<\/a> can be a reality in today\u2019s IT world thanks to the JumpCloud Directory Platform<\/a>.<\/p>\n\n\n\n At the core of any access request is a secure, verified user identity with the correct permissions for accessing the desired resource, whether it\u2019s a virtualized Linux desktop or an Amazon EC2 instance. By unifying identity, access, and device management into a consolidated, cloud-based console, sysadmins using JumpCloud can reap the benefits of simplified workflows, robust security controls, and comprehensive visibility into their IT environments. JumpCloud\u2019s management capabilities expand beyond SSH and Linux management, to SAML, LDAP, RADIUS, Mac, Windows, and more to effectively meet the demands of your modern IT needs.<\/p>\n\n\n\nPrivate and Public SSH Keys<\/strong><\/h2>\n\n\n\n
<\/code>file.<\/p>\n\n\n\n
How SSH Authentication Works<\/strong><\/h2>\n\n\n\n
1. Password-based authentication<\/h3>\n\n\n\n
2. Public key authentication<\/h3>\n\n\n\n
How to Generate an SSH Key Pair<\/strong> on Linux<\/h2>\n\n\n\n
$ ssh-keygen -t rsa<\/code><\/p>\n\n\n\n
<\/figure>\n\n\n\n
Save the SSH Key to a Location<\/h3>\n\n\n\n
<\/code>~\/.ssh<\/kbd> folder (for example, \/user\/home\/.ssh<\/kbd>). If you wish to save the keys in this location, simply press \u201cENTER.\u201d<\/p>\n\n\n\n
<\/code>directory.<\/p>\n\n\n\n
$ ls -l ~\/.ssh<\/code><\/p>\n\n\n\n
<\/code>is the private key which, as mentioned, should be kept top-secret on the client system to prevent potential compromise.<\/p>\n\n\n\n
<\/code>is the public key that can be freely shared with the server you intend to connect to.<\/p>\n\n\n\n
<\/figure>\n\n\n\n
Copy the Public Key to the Remote Server<\/h3>\n\n\n\n
<\/code>command:<\/p>\n\n\n\n
$ ssh-copy-id username@remote-server-IP<\/code><\/p>\n\n\n\n
<\/code>file on the remote system.<\/p>\n\n\n\n
<\/figure>\n\n\n\n
Log in with SSH Passwordless Authentication<\/h3>\n\n\n\n
$ ssh remote-server-ip<\/code><\/p>\n\n\n\n
<\/figure>\n\n\n\n
Troubleshooting Common Issues<\/h2>\n\n\n\n
Permission Denied Errors<\/h3>\n\n\n\n
\n
\n
chmod 600 ~\/.ssh\/id_rsa<\/code><\/li>\n\n\n\n
chmod 700 ~\/.ssh<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n
\n
chmod 600 ~\/.ssh\/authorized_keys<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n
\n
ssh-keygen -lf ~\/.ssh\/id_rsa.pub<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
ssh-agent<\/kbd> Not Running<\/h3>\n\n\n\n
\n
eval $(ssh-agent -s)<\/code><\/li>\n\n\n\n
ssh-add ~\/.ssh\/id_rsa<\/code>\n
\n
ssh-add -l<\/code><\/li>\n<\/ol>\n\n\n\n
Incorrect ~\/.ssh\/config<\/kbd><\/h3>\n\n\n\n
\n
ssh -F ~\/.ssh\/config -T<\/code>\n
\n
\n
Host github.com
HostName github.com
User git
IdentityFile ~\/.ssh\/id_rsa_github
Host server.example.com
HostName server.example.com
User your_username
IdentityFile ~\/.ssh\/id_rsa_server<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\nssh -v your_username@server.example.com<\/code><\/li>\n<\/ol>\n\n\n\n
How to Manage Linux SSH Keys<\/strong><\/h2>\n\n\n\n
1. Use an SSH key manager to automate the handling of SSH keys<\/h3>\n\n\n\n
2. Apply the principle of least privilege when using SSH keys<\/h3>\n\n\n\n
3. Remove idle and orphaned SSH keys<\/h3>\n\n\n\n
4. Use different keys for different users and environments<\/h3>\n\n\n\n
5. Periodically rotate your SSH keys <\/h3>\n\n\n\n
6. Enforce strict SSH key management policies <\/h3>\n\n\n\n
Advanced SSH Key Management<\/strong><\/h2>\n\n\n\n
Use Different Key Types<\/strong><\/h3>\n\n\n\n
\n
\n
ssh-keygen -t ecdsa -b 521<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n
\n
ssh-keygen -t ed25519<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n
\n
Restrict Key Usage on the Server Side<\/strong><\/h3>\n\n\n\n
\n
\n
command=”\/usr\/bin\/your_script”,no-port-forwarding ssh-rsa AAAAB3… user@host<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n
\n
no-agent-forwarding ssh-rsa AAAAB3… user@host<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n
\n
no-pty ssh-rsa AAAAB3… user@host<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
\n
nano ~\/.ssh\/authorized_keys<\/code><\/li>\n\n\n\n
Secure Linux SSH Key Management With JumpCloud<\/strong><\/h2>\n\n\n\n