Generate a dedicated key

An SSH key is a pair of files. The private key stays on your computer and signs things. The public key goes on servers, and it can only check those signatures. Anyone can have the public half. Nobody but you should ever have the private half.

Most people have one key, id_ed25519, and use it for GitHub, work servers, a Raspberry Pi, and everything else. It works. It also means that losing one laptop means rotating access to everything at once, and you cannot tell from a server which device connected.

I prefer one key per security boundary. The key for this course’s VPS is not the key I use for Git hosting, and it is not the key any automation uses.

Create the key

Give it a filename that says what it is for, and a comment that says who owns it:

ssh-keygen -t ed25519 -f ~/.ssh/notes_server_ed25519 -C 'flavio notes-server operator'

ed25519 is the modern default. It is fast, the keys are short, and every OpenSSH from the last decade supports it. When asked for a passphrase, type one. The next lesson explains why.

You now have two files:

ls -l ~/.ssh/notes_server_ed25519*

-rw-------  1 flavio  staff  464 Sep  8 10:12 /Users/flavio/.ssh/notes_server_ed25519
-rw-r--r--  1 flavio  staff   99 Sep  8 10:12 /Users/flavio/.ssh/notes_server_ed25519.pub

Notice the permissions. The private file is readable only by you. The .pub file can be world-readable, because it is public.

Look at what you made

Print the public key:

cat ~/.ssh/notes_server_ed25519.pub

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN7fQ2... flavio notes-server operator

That one line is what you will paste into authorized_keys on the server. The comment at the end travels with it, so a year from now someone reading the server file knows which key this is.

Print the fingerprint too:

ssh-keygen -lf ~/.ssh/notes_server_ed25519.pub

256 SHA256:9kLm3nQ7rT2vW5xY8zA1bC4dE6fG0hJ3kM7nP2qR5sU flavio notes-server operator (ED25519)

Write this fingerprint down. Servers, Git providers, and ssh -v all identify keys by fingerprint, not by filename. When something says “offering key SHA256:9kLm…”, this is how you know which file it means.

The private half never moves

Try this: run ssh-keygen -lf on the private file instead of the .pub. You get the same fingerprint, because the public key is derived from the private one. That is the only thing you should ever do with the private file besides using it to connect. Do not scp it to the server, paste it into a dashboard, or commit it. If a tutorial tells you to copy the private key somewhere, the tutorial is wrong.

One realistic failure: you create the key without -f and ssh-keygen offers to overwrite ~/.ssh/id_ed25519. Say no. Overwriting a key you still use locks you out of every server that trusts it.