download

To create a SSH public/private key pair on a FreeBSD host, the ssh-keygen(1)utility should be used as follows:$ ssh-keygenGenerating public/private rsa key pair.Enter file in which to save the key (/home/babak/.ssh/id_rsa):Created directory '/home/babak/.ssh'.Enter passphrase (empty for no passphrase):Enter same passphrase again:Your identification has been saved in /home/babak/.ssh/id_rsa.Your public key has been saved in /home/babak/.ssh/id_rsa.pub.The key fingerprint is:cc:73:cd:6f:9e:72:da:cd:54:ab:2f:f1:56:7c:b5:b2 babak@myhostChapter 13In the above example, simply running the ssh-keygen command starts creating afresh pair of SSH public and private keys using the RSA encryption algorithm. Oncethe key is generated, it asks where it should save the private key file. The defaultfile name is id_rsa and it is saved under the .ssh directory, in your home directory.You can change it if you want to save it under a different name or path. Otherwise,pressing enter will take the defaults.You also have the choice to protect your key using a password, which is a very wisething to do. If your keys are not protected, anyone can use these keys to log into yourhosts without any restriction. Protecting keys with a password will reduce the risk ofabusing the keys in case of key theft. The ssh-keygen utility asks whether you wantto protect the private key through a password. You can enter a password (a strongpassword is suggested) or simply hit enter to bypass password protection.Then it saves the public key under the same path that you've chosen, in the defaultname id_rsa.pub. It also shows your unique key fingerprint, which in this case is a128-bit hexadecimal string.You can verify the result by seeing your keys under the .ssh directory as follows:$ ls -l .ssh/total 4-rw------- 1 babak babak 1679 Nov 7 21:15 id_rsa-rw-r--r-- 1 babak babak 412 Nov 7 21:15 id_rsa.pubThe private key, id_rsa, has a default permission of 0600, which means that only theowner of the key can read or modify the key file. However, the public key, id_rsa.pub, is readable by all other users. In fact, you should safeguard your private keys,though you can freely distribute the public keys to be used on the other hosts.[ 209 ]