How to Generate an SSH Key in Ubuntu 22.04/22.10?

Are you looking to secure your remote connections in Ubuntu 22.04/22.10 with Secure Shell (SSH)? One of the first steps you’ll need to take is generating an SSH key pair, which consists of a private key and a public key. The private key is kept on your local machine, while the public key is shared with the remote server. With SSH key authentication, you can log in to remote servers securely and without needing to remember your password.

In this tutorial, we’ll guide you through the process of generating an SSH key pair on your Ubuntu 22.04/22.10 machine, so you can take advantage of this powerful security feature.

What is SSH and Why It’s Important?

SSH, or Secure Shell, is a cryptographic network protocol used for secure communication over an unsecured network. It’s primarily employed to remotely access and manage servers, allowing users to execute commands and transfer files securely.

SSH is important because it provides a high level of security through encryption and authentication, protecting sensitive data from being intercepted or tampered with during transmission. This is particularly crucial for system administrators and developers who require secure remote access to servers and network devices.

The First Step in Using SSH

Generating an SSH key is the first step in using SSH for secure communication between a client and a server. An SSH key is a pair of cryptographic keys, one public and one private, which are used for authentication and encryption purposes.

The public key is shared with the server, while the private key remains securely on the client’s machine. When a client attempts to connect to the server, the server uses the public key to encrypt a challenge message. The client then uses the private key to decrypt the message and send it back to the server. If the response is correct, the server grants access, confirming the client’s identity without revealing the private key.

Creating an SSH key helps to strengthen security by reducing reliance on password-based authentication, which can be vulnerable to brute force attacks and password theft. Additionally, using SSH keys simplifies the process of remote server access by allowing for automated authentication, such as in the case of automated scripts or deployment tools.

Checking for Existing SSH Keys

To check if you already have an SSH key on your system, follow these steps depending on your operating system:

For Linux or macOS:

1. Open a terminal window.

2. Navigate to the default SSH directory by running the command:

cd ~/.ssh

3. List the contents of the directory using the command:

ls –al

If you see files named id_rsa and id_rsa.pub (or similar, like id_ecdsa, id_ed25519), then you have an existing SSH key pair. The .pub file is the public key, while the file without the extension is the private key.

For Windows:

1. Open File Explorer.

2. In the address bar, enter the following path and press Enter:

%USERPROFILE%\.ssh

3. Check if the folder contains files named id_rsa and id_rsa.pub (or similar, like id_ecdsa, id_ed25519).

If they are present, then you have an existing SSH key pair. The .pub file is the public key, while the file without the extension is the private key.

If you don’t find any existing SSH keys, you can generate a new key pair by following the appropriate steps for your operating system and SSH client.

Generating a New SSH Key in Ubuntu 22.04/22.10

The command to generate a new SSH key in Ubuntu 22.04/22.10 is the same as in other Linux distributions, as it uses the same ssh-keygen utility. Here’s the command you can use:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

This command generates a 4096-bit RSA key pair, which offers a good balance between security and performance. You can replace “your_email@example.com” with your actual email address or another identifier.

When you run the command, you’ll be prompted to choose a location to save the key pair. Press Enter to accept the default location (~/.ssh/id_rsa for the private key and ~/.ssh/id_rsa.pub for the public key) or specify a different file path. You will also be prompted to enter a passphrase to further secure the private key. You can either enter a strong passphrase or leave it empty for passwordless authentication.

After completing these steps, the SSH key pair will be generated, and you can proceed to add the public key to the server or any other services that require authentication using SSH keys.

Custom Key Generation

The ssh-keygen command offers several options to customize key generation. Here’s a description of some commonly used options:

-t KEY_TYPE: Specifies the type of key to generate. The KEY_TYPE can be rsa, dsa, ecdsa, or ed25519. For example, -t rsa generates an RSA key pair.

By choosing the key type, users can decide which cryptographic algorithm to use. Each algorithm has its strengths and weaknesses, and some are considered more secure or efficient than others (e.g., Ed25519 is considered more secure and faster than RSA).

-b KEY_LENGTH: Defines the key length in bits, primarily used with RSA and DSA keys. For example, -b 4096 generates a 4096-bit RSA key.

The key length affects the security of the generated keys. A longer key is generally more secure but may increase connection times and computational overhead. Users can balance security and performance by adjusting the key length (e.g., using 4096 bits for RSA keys).

-C COMMENT: Adds a comment to the key, usually an email address or identifier. For example, -C “your_email@example.com” associates the key with the specified email address.

Adding a comment helps users manage multiple keys by providing an identifier, such as an email address. When working with multiple servers or services, it’s helpful to know which key belongs to which account or purpose.

-f FILE: Specifies the file path for the generated key pair. The public key will have a .pub extension added. For example, -f ~/.ssh/my_key saves the private key as my_key and the public key as my_key.pub.

Specifying a custom file path allows users to organize their keys according to their preferences. Users can maintain separate keys for different servers or services, improving security by limiting the potential impact of a compromised key.

-N PASSPHRASE: Sets a passphrase to encrypt the private key. Replace PASSPHRASE with the desired passphrase or use an empty string for passwordless authentication. For example, -N “mypassword”.

Encrypting the private key with a passphrase adds an extra layer of security, preventing unauthorized access even if the private key file is compromised. Users can choose a strong passphrase or opt for passwordless authentication, depending on their security requirements and convenience.

-q: Quiet mode. Suppresses output messages and feedback when running ssh-keygen in scripts or automating key generation.

An example command using some of these options:

ssh-keygen -t ed25519 -C "your_email@example.com" -f ~/.ssh/id_ed25519 -N "secure_passphrase"

This command generates an Ed25519 key pair, associates it with the specified email address, saves the keys with custom filenames, and secures the private key with a passphrase.

Keep in mind that these options can be combined according to your requirements. For more options and details, you can refer to the ssh-keygen manual by running man ssh-keygen in the terminal.

Adding the Public Key to Your Server

To add your public SSH key to a remote server and enable key-based authentication, follow these steps:

1. First, make sure you have generated an SSH key pair on your local machine, as previously described.

2. On your local machine, display the contents of your public key file using the cat command (assuming the default file path and an RSA key):

cat ~/.ssh/id_rsa.pub

This command will output the contents of your public key file. Select and copy the entire key, which should look something like this:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ... your_email@example.com

3. Connect to the remote server using your username and the server’s IP address or hostname, and authenticate using your password:

ssh username@server_ip_or_hostname

4. Once connected, create the ~/.ssh directory on the remote server if it doesn’t already exist:

mkdir -p ~/.ssh

5. Set the appropriate permissions for the ~/.ssh directory:

chmod 700 ~/.ssh

6. Open the authorized_keys file in the ~/.ssh directory using a text editor (or create the file if it doesn’t exist). Here’s an example using the nano text editor:

nano ~/.ssh/authorized_keys

7. Paste your public key (which you copied in step 2) into the authorized_keys file. Ensure that each public key is on a new line if there are multiple keys.

8. Save the changes and exit the text editor. In the case of nano, press Ctrl + X, then Y, and finally Enter.

9. Set the appropriate permissions for the authorized_keys file:

chmod 600 ~/.ssh/authorized_keys

10. Disconnect from the remote server by typing exit or logout.

Your public key is now added to the remote server. The next time you connect to the server using ssh, the server will authenticate you using your SSH key instead of your password. When you set a passphrase for your private key, the system will prompt you to enter it when you connect to the remote server.

Copying the Public Key to the Server

You can also use the ssh-copy-id command to easily copy your public key to a remote server. The command automatically handles creating the ~/.ssh directory, updating the authorized_keys file, and setting the correct permissions. Here’s the command format:

ssh-copy-id -i KEY_FILE username@server_ip_or_hostname

Replace KEY_FILE with the path to your public key file (e.g., ~/.ssh/id_rsa.pub), username with your remote server’s username, and server_ip_or_hostname with the server’s IP address or hostname.

For example, if you are using the default RSA public key and your username is “john” on a server with an IP address of “192.168.1.10”, the command would be:

ssh-copy-id -i ~/.ssh/id_rsa.pub john@192.168.1.10

You will be prompted to enter your remote server’s password. After the command completes successfully, your public key will be added to the authorized_keys file on the remote server, and you can use key-based authentication for future SSH connections.

Test if the Key is Working

To test if your SSH key is working correctly for key-based authentication with the remote server, follow these steps:

1. On your local machine, open a terminal or command prompt.

2. Initiate an SSH connection to the remote server using your username and the server’s IP address or hostname:

ssh username@server_ip_or_hostname

Replace username with your remote server’s username, and server_ip_or_hostname with the server’s IP address or hostname.

3. You should be able to connect to the server without entering your password. The server will authenticate you using your SSH key.

• When you set a passphrase for your private key, the system will prompt you to enter it. Once you enter the correct passphrase, you will gain access to the remote server.
• If you did not set a passphrase for your private key, the system will grant you access to the remote server without requiring any additional authentication

Conclusion

Generating an SSH key is a critical step in securing remote access to servers and network devices. Using SSH keys instead of relying solely on password-based authentication significantly enhances security, protects sensitive data from interception or tampering, and reduces the risk of unauthorized access through brute force attacks or password theft.

Furthermore, SSH keys simplify the process of remote server access, allowing for automated authentication in scripts and deployment tools.

To recap, generating an SSH key in Ubuntu 22.04/22.10 involves the following steps:

1. Open a terminal window.

2. Run the ssh-keygen command with appropriate options, such as:

ssh-keygen -t rsa -b 4096 -C your_email@example.com

3. Choose a location to save the key pair when prompted or accept the default location.

4. Optionally, set a passphrase for the private key to further secure it.

Once you’ve generated your SSH key pair, you can add the public key to your remote server and start using key-based authentication for secure access.

We strongly encourage using SSH for remote access to servers and adopt SSH key-based authentication as a best practice. By doing so, you not only increase the security of your connections but also contribute to a safer and more reliable digital environment.

Share this information along to a friend if you find it useful. If you want to know the best way to install and safely secure an Ubuntu server, click here. You can also explore our VPS hosting plans if you’re looking for a VPS to host a website.