Subscribe to the Data Center Knowledge Newsletter
Get analysis and expert insight on the latest in data center business and technology delivered to your inbox daily.
SSH-Keygen Essentials: How to Generate and Manage SSH Keys
Learn everything you need to know about SSH key generation and management to enhance your network security profile.
Jack Vaughan
June 10, 2024
4 Min Read
Alamy
The SSH protocol provides advanced communications protection to guard against security vulnerabilities including ransomware and other attacks.
For system administrators and users, it all begins with the ssh-keygen tool, which acts as the important enabler of SSH key creation and management.
The Purpose of SSH Keys
SSH keys (short for ‘Secure Shell keys’) can provide a supplement or alternative to traditional username-and-password access methods. The password methods can become particularly pervious to phishing and brute-force cyber-attacks.
For its part, the SSH protocol works by coupling a public key residing on a server with a corresponding private key located on a client machine. That allows systems to communicate encrypted information across unsecured networks.
Taken together, these keys constitute a key pair that stands as a secure access credential for authentication. That is useful for data center servers, as well as remote networked servers and clients. The ssh-keygen tool for key generation thus become an important tool in administrator and user toolboxes.
How Does the SSH Protocol Work?
The SSH protocol uses the application layer above the transport layer in the TCP/IP stack. SSH key pairs employ public key infrastructure (PKI) to provide encrypted operations.
Here, the basic handshake is described:
In first establishing a secure connection between an SSH Client and an SSH Server, a client device utilizes a terminal shell (A.K.A., a command prompt shell), to start the communications process by contacting the server.
In turn, the server sends its public key to the client. The server public key is used to encrypt data and is usable by any client.
The client matches the public key to an appropriate entry its local SSH configuration (such as ~/.ssh/known_hosts) for the public key associated with the server's hostname. The client verifies this and confirms the server identity.
In client authentication, the client proves its identity to the server by sending its public key.
The server generates a random challenge and encrypts it with the client’s public key.
Then, the client uses its private key to decrypt the challenge.
The client encrypts the response with the server's public key that it received during server verification and sends it back. It thus proves that it possesses the corresponding private key.
The client is granted access, and a secure channel is established via the shared key for encrypted communications.
The ssh-keygen utility is supported at the command-line level by Unix, Linux, MacOS, Windows and other operating systems for generating secure keys. It is also used to manage and convert authentication keys.
Among public key cryptographic algorithms that can be used with ssh-keygen tools are DSA, ECDSA, ECDSA-SK, ED25519, and RSA.
How to Choose Strong Algorithms and Key Sizes
The choice of algorithm and key length is an important step in key creation, and implementors must balance factors such as latency, computational overhead required, and level of security in selecting a key’s big length, which can typically range from 256 bits to 4096 bits depending on the algorithm version. In fact, bit-counts can range much higher.
Still, some modern cryptographic algorithms can achieve excellent security with relatively modest bit complements.
SSH-Keygen Commands
SSH is a protocol, not a software program, but ssh-keygen commands are naturally essential to operations. Among important commands are the following:
ssh-keygen -t
This command generates new pairs using the RSA PKI algorithm.
ssh-copy -id
This command works to install a key.
-e flag
This command asserts that the user wants to use a private key file for authentication. Options to this operation include
-f input_keyfile / -m key_format
These commands both specify the private key file format.
SSH Keygen General Commands
The infographic below outlines some common ssh-keygen commands:
SSH Keygen Features and Enhancements
The ssh-keygen protocol receives enhancements over time. These include new cryptographic algorithms, features, and bug fixes. Useful updates have been a marked characteristic since the advent of SSH-1. That original effort saw continually greater use.
A Brief of History of SSH
SSH-1 first gained use as an alternative to a Telnet (Teletype Network) protocol originally used for handling internet communications. The roots of SSH trace to 1995, when a password-sniffing attack caused Finnish researcher Tatu Ylönen to devise the protocol using RC4 encryption.
At the time, network sniffers had begun to find use observing and capturing packetized information. These hardware-based sniffers were joined with software-based sniffers over time. The original SSH encryption cypher has been subsequently updated.
As with any other technology choice, the SSH key is not a Silver Bullet. The SSH key and associated processes require careful design and management to protect communications. Still, the SSH protocol has proved to be more than a somewhat useful replacement for Telnet.
Addressing Admin Concerns
The ssh-keygen provides data center staff with an alternative to traditional usernames and passwords for accessing remote servers. However, the ssh-keygen command’s wide use must be tempered with the understanding that SSH keys can proliferate wildly in an organization – thus, requiring consistent attention to key management.
For optimal management, ssh-keygen admins and users should pay attention to key rotation, secure private key storage, and general compliance practices relevant to their use cases.
The ability for administrators to independently assign encrypted communications garners great benefit in organizations that need to move quickly while still ensuring network security.
About the Author
You May Also Like
