{"id":8030,"date":"2025-03-19T10:48:01","date_gmt":"2025-03-19T10:48:01","guid":{"rendered":"https:\/\/cloudvpshosts.com\/kb\/?p=8030"},"modified":"2025-03-19T10:48:01","modified_gmt":"2025-03-19T10:48:01","slug":"setting-up-an-ssh-key","status":"publish","type":"post","link":"https:\/\/cloudvpshosts.com\/kb\/setting-up-an-ssh-key\/","title":{"rendered":"Setting up an SSH key"},"content":{"rendered":"
\n
\n
\n
\n

Introduction<\/h2>\n

In this tutorial you will learn how to work with an SSH key. This will include generating an SSH key pair, copying the public key to a remote device and deleting an SSH key pair.<\/p>\n

SSH key explained<\/p>\n

Secure Shell (SSH) is a network protocol that is used for encrypted communication between two devices. To establish an SSH connection, you can either use a password or an SSH key for authentication. A single SSH key pair has two components, a private key and a public key. Each key consists of a long string of characters.<\/p>\n

    \n
  • The public key uses a specific algorithm to encrypt messages.<\/li>\n
  • The private key uses a specific algorithm to decrypt messages.<\/li>\n<\/ul>\n

    Only a private key can decrypt messages that have been encrypted with a public key and both keys have to be part of the same key pair. The public key is saved on all remote devices you want to connect to via the key. This means that anyone in possession of your private key can also decrypt all messages from that device. For this reason, the private key should always be kept secret and never be shared. One of the advantages of this authentication method is that it is more secure than passwords.<\/p>\n

    SSH keys allow to automatically authenticate connections. There are mainly 4 steps:<\/p>\n

      \n
    1. The public key of the client has to be on the server.<\/li>\n
    2. The server uses the public key to encrypt a random message that is then sent to the client.<\/li>\n
    3. The client uses the private key to decrypt the message.<\/li>\n
    4. If the message has been decrypted correctly, the connection is authenticated.<\/li>\n<\/ol>\n

      \"ssh\"Prerequisites<\/p>\n

        \n
      • Basic knowledge about the Hetzner Cloud<\/li>\n
      • CLI tool<\/li>\n<\/ul>\n

        Example terminology<\/p>\n

          \n
        • Username: holu<\/li>\n
        • IPv4: <10.0.0.1><\/li>\n<\/ul>\n

          Please replace\u00a0holu<\/code>\u00a0with your username and\u00a0<10.0.0.1><\/code>\u00a0with your own IP address in all example commands.<\/p>\n

          Step 1 \u2013 Generating an SSH key<\/h2>\n

          To create an SSH key on your local device, please open your CLI. Generally, it is enough to run\u00a0ssh-keygen<\/code>\u00a0without any other specifications. This will create an\u00a0RSA<\/code>\u00a0key by default.<\/p>\n

          ssh-keygen<\/code><\/pre>\n
          It is also possible to provide additional information about key type and key size.<\/p>\n
          Options:<\/p>\n
            \n
          • -t<\/code>\u00a0specifies the key type<\/li>\n
          • -b<\/code>\u00a0specifies the key size<\/li>\n<\/ul>\n
            Type:<\/p>\n
              \n
            • rsa<\/code><\/li>\n
            • ed25519<\/code><\/li>\n
            • dsa<\/code><\/li>\n
            • ecdsa<\/code><\/li>\n<\/ul>\n
              Depending on the type, different algorithms are used. DSA and ECDSA both include a parameter (k<\/code>) that can be problematic in terms of security. If the same parameter is used twice, attackers can use this information to recover the\u00a0private key. Mathematically, Ed25519 is probably one of the strongest keys. If your device does not support this key, you can also generate an RSA key.<\/p>\n
                \n
              1. Ed25519 keyEd25519 is considered to be very secure. It is supported by OpenSSH 6.5 (2014) and all versions that followed. If your device does support this key, we recommend using it. The key size is fixed and cannot be changed.$ ssh-keygen -t ed25519<\/code><\/li>\n
              2. RSA keyCompared to other keys, RSA can be considered to be relatively old. It is not quite as secure as an Ed25519 key. RSA has a default key size of 3072 bits and should never be under 1024 bits. To increase security, you can set the key size to be 4096 bits.$ ssh-keygen -t rsa -b 4096<\/code><\/li>\n
              3. ECDSA keyECDSA is supported by OpenSSH 5.7 (2011) and all versions that followed. You can set the key size to be 256, 384 or 521 bits. The default setting is 256 bits.<\/li>\n
              4. DSA keyDSA is considered to be relatively insecure. Support ended with OpenSSH 7.0 (2017). The key size is fixed as 1024 bits and cannot be changed.<\/li>\n<\/ol>\n
                Once you run the command to generate an SSH key, you should get an output that looks like this:<\/p>\n
                Generating public\/private <type> key pair.\r\nEnter file in which to save the key (\/<your_home>\/.ssh\/id_<type>):<\/code><\/pre>\n
                The default location to save the key is\u00a0\/<your_home>\/.ssh\/id_<type><\/code>. You can press\u00a0ENTER<\/code>\u00a0to confirm the default setting or specify another location. If possible, you should keep the default. This way, the SSH client will be able to find the key automatically when authenticating. If you already have an SSH key of the same type, you might get something like this:<\/p>\n
                \/home\/your_home\/.ssh\/id_<type> already exists.\r\nOverwrite (y\/n)?<\/code><\/pre>\n
                If you enter\u00a0y<\/code>, the existing SSH key will be overwritten and you will no longer be able to use it.<\/p>\n
                Once the location is set, you should be asked to set a passphrase.<\/p>\n
                Enter passphrase (empty for no passphrase):\r\nEnter same passphrase again:<\/code><\/pre>\n
                A passphrase increases security even further. If you set a passphrase, you will be asked to enter it every time you use your key. If you press\u00a0ENTER<\/code>\u00a0without entering a passphrase, your SSH key will not have a passphrase. Output:<\/p>\n
                Your identification has been saved in \/<your_home>\/.ssh\/id_<type>\r\nYour public key has been saved in \/<your_home>\/.ssh\/id_<type>.pub<\/code><\/pre>\n
                The SSH key has now been generated and has been saved in the location you set earlier.<\/p>\n
                Step 2 \u2013 Opening the SSH key<\/h2>\n
                When you generate an SSH key, an SSH directory with several files is created too. Important files include:<\/p>\n