How to Manage Multiple SSH Key Pairs

I recently overheard someone say that he uses the same SSH key for all of his accounts, which is a bad idea from a security perspective. Additionally, Bitbucket recommends users replace their SSH keys once a year for security. Following these steps wil…


This content originally appeared on DEV Community and was authored by Joseph Midura

I recently overheard someone say that he uses the same SSH key for all of his accounts, which is a bad idea from a security perspective. Additionally, Bitbucket recommends users replace their SSH keys once a year for security. Following these steps will ensure that you can.

When I initially started managing multiple SSH key/password combinations on my personal machine, I learned best practices from a variety of sources. I’m writing this information down in one place for the benefit of others. My current OS of choice is MacOS, but these instructions should work for any *nix system.

First

Open terminal and navigate to ~/.ssh to generate a new SSH key:

ssh-keygen -t rsa -f key_name -b 4096

Here is what each flag means:

  • -t specifies the algorithm that makes the key.
  • -f specifies a custom name for the key (assuming you're in the ~/.ssh directory), and an alternate location if it’s in the form of a path.
  • personal_key is the name of the key. Make this as specific as possible.
  • -b specifies how many bits long the key will be. Bitbucket's current documentation recommends 2048 bits, but I recommend 4096 as RSA will soon be replaced by the ed25519 public key algorithm. I always use a key name that is specific and makes sense to me. This makes key management easier in the long term.

You should use a passphrase when prompted.

Second

When you complete the first step two files are created: key_name and key_name.pub. The first is your private key and the second (with the .pub extension) is your public key.
Create a known_hosts file for each account you have because it makes diagnosing issues easier when you have multiple keys. Ideally the name of this file is similar enough to the key name that you aren’t confused later.

touch known_hosts_keyname

Third

The config file sets options for each host. Create the config file if it doesn’t already exist and then open it for editing. I label each key for visual neatness and to avoid confusion as the list of keys gets longer over time. Create a comment using the # at the start of a line to label each host.

config

Here is the breakdown of what each line means:

  • The URL on the HostName line is the base URL where the repository resides. For example, if you have a personal account on github with personal projects, the URL will be github.com.
  • Host is a pattern matcher that is used to differentiate between these sets of configurations. Keep it the same as the HostName so it matches hosts in connections correctly without additional specification.
  • User for git based systems will be git. The value of User will be different if you connect to something else (i.e. ec2-user for connecting to an Amazon AWS EC2 instance)
  • IdentityFile asks for the location of the identity key we made. Type in the respective path here.
  • UserKnownHostsFile specifies an exact location to store all hosts you connect to when you’re using that profile. Provide the respective paths here and choose a unique known hosts file name (see step 2 above) so that troubleshooting and key maintenance over time is easier.
  • IdentitiesOnly specifies that only the keys provided must be used to connect to a host, even if another service like the ssh-agent offers a key for use.

Fourth

Add keys to ssh agent if passphrase was used. Skip to the next step if you didn't use a passphrase. Start the ssh agent in the terminal:

eval "$(ssh-agent -s)"

Add private keys to the agent in terminal:

ssh-add -K path_to_private_keyname

Note that the -K option works only on mac for keychain access.

Fifth

Add public Keys to clipboard:

cat key_name.pub | pbcopy

Finally, paste the public key into the appropriate account.

With multiple keys, I have the option of creating new keys as needed to keep each connection secure. If I have a single compromised key, then I only worry about changing that single key. My config file makes it easy for me to use multiple keys.

References
Bitbucket documentation
Github documentation


This content originally appeared on DEV Community and was authored by Joseph Midura


Print Share Comment Cite Upload Translate Updates
APA

Joseph Midura | Sciencx (2021-04-18T20:49:28+00:00) How to Manage Multiple SSH Key Pairs. Retrieved from https://www.scien.cx/2021/04/18/how-to-manage-multiple-ssh-key-pairs/

MLA
" » How to Manage Multiple SSH Key Pairs." Joseph Midura | Sciencx - Sunday April 18, 2021, https://www.scien.cx/2021/04/18/how-to-manage-multiple-ssh-key-pairs/
HARVARD
Joseph Midura | Sciencx Sunday April 18, 2021 » How to Manage Multiple SSH Key Pairs., viewed ,<https://www.scien.cx/2021/04/18/how-to-manage-multiple-ssh-key-pairs/>
VANCOUVER
Joseph Midura | Sciencx - » How to Manage Multiple SSH Key Pairs. [Internet]. [Accessed ]. Available from: https://www.scien.cx/2021/04/18/how-to-manage-multiple-ssh-key-pairs/
CHICAGO
" » How to Manage Multiple SSH Key Pairs." Joseph Midura | Sciencx - Accessed . https://www.scien.cx/2021/04/18/how-to-manage-multiple-ssh-key-pairs/
IEEE
" » How to Manage Multiple SSH Key Pairs." Joseph Midura | Sciencx [Online]. Available: https://www.scien.cx/2021/04/18/how-to-manage-multiple-ssh-key-pairs/. [Accessed: ]
rf:citation
» How to Manage Multiple SSH Key Pairs | Joseph Midura | Sciencx | https://www.scien.cx/2021/04/18/how-to-manage-multiple-ssh-key-pairs/ |

Please log in to upload a file.



There are no updates yet.
Click the Upload button above to add an update.

You must be logged in to translate posts. Please log in or register.

Related Posts