@@ -77,31 +77,31 @@ Quick summary, if you just need a reminder:
...
@@ -77,31 +77,31 @@ Quick summary, if you just need a reminder:
| `ssh-add ~/.ssh/id_ed25519` | provide private key identity to agent |
| `ssh-add ~/.ssh/id_ed25519` | provide private key identity to agent |
| `ssh-add -l` | list managed identities (should show at least one entry) |
| `ssh-add -l` | list managed identities (should show at least one entry) |
Please keep reading below if you require more details.
Please keep reading if you require more details.
An SSH key pair always consists of a private key (as in **private - don't share, don't give away**) and a public key. As with physical keys, one does not want to share private keys or leave their copies in other locations/computers. Instead, we recommend to create new SSH key pairs on each frequently-used host. Let's outline a **3-step procedure** to get you "keyed-in".
An SSH key pair always consists of a private key (as in **private - don't share, don't give away**) and a public key. As with physical keys, one does not want to share private keys or leave their copies in other locations/computers. Instead, we recommend to create a new SSH key pair on each frequently-used host. Let's outline a **3-step procedure** to get you "keyed-in".
The type of key to be generated is specified with the `-t` option, where we recommend the type "ed25519" for enhanced security. You can then confirm the default file location by hitting ENTER.
The type of key to be generated is specified with the `-t` option, where we recommend the "ed25519" algorithm for enhanced security. You can then confirm the default file location by hitting ENTER.
```
```
Enter file in which to save the key (/home/<USERNAME>/.ssh/id_ed25519):
Enter file in which to save the key (/home/<USERNAME>/.ssh/id_ed25519):
```
```
Outdated SSH versions may not allow for the key type "ed25519". In this case, use
Outdated SSH versions may not support key type "ed25519". In this case, use
```
```
ssh-keygen -t rsa -b 4096 -C "<YOUR NAME>"
ssh-keygen -t rsa -b 4096 -C "<YOUR NAME>"
```
```
Below, we keep assuming type "ed25519".
Below, we keep assuming type "ed25519".
Next you **have to** enter a passphrase. Empty or weak passphrases present other vulnerabilities. Therefore, for your convenience, this [passphrase generator](https://www.tu-braunschweig.de/it-sicherheit/pwsec/pwgen) assists in a secure choice.
Next you **have to** enter a passphrase. Empty or weak passphrases present serious vulnerabilities. Therefore, for your convenience, this [passphrase generator](https://www.tu-braunschweig.de/it-sicherheit/pwsec/pwgen)may assists you in selecting a secure passphrase.
```
```
Enter passphrase (empty for no passphrase):
Enter passphrase (empty for no passphrase):
```
```
**We stress the importance of a non-empty and secure** passphrase! As usual, store the passphrase in a secure place or use a password-manager ([e.g. KeePass](https://keepass.info/download.html)). In Step 3 (2.2.3) below, we outline how to dodge typing that passphrase multiple times.
**We stress the importance of a non-empty and secure** passphrase! As usual, store the passphrase in a secure place or use a password-manager ([e.g. KeePass](https://keepass.info/download.html)). In Step 3 (2.2.3) below, we outline how to avoid typing that passphrase multiple times.
```
```
Enter same passphrase again:
Enter same passphrase again:
Your identification has been saved in /home/<USERNAME>/.ssh/id_ed25519
Your identification has been saved in /home/<USERNAME>/.ssh/id_ed25519
...
@@ -117,7 +117,7 @@ The key's randomart image is:
...
@@ -117,7 +117,7 @@ The key's randomart image is:
You will now see the key pair in the hidden `.ssh` directory of your home as files `~/.ssh/id_ed25519` and `~/.ssh/id_ed25519.pub` (or `~/.ssh/id_rsa` and `~/.ssh/id_rsa.pub`).
You will now see the key pair in the hidden `.ssh` directory of your home as files `~/.ssh/id_ed25519` and `~/.ssh/id_ed25519.pub` (or `~/.ssh/id_rsa` and `~/.ssh/id_rsa.pub`).
##### (on Windows: you can also use [PuTTY](PuTTY-key-generator) )
##### (on Windows: you can also use [PuTTY](PuTTY-key-generator) )
#### 2.2.2 Step 2: Transfer the public key
#### 2.2.2 Step 2: Transfer the public key
You can now send us the **public** key (`id_ed25519.pub`), either as a file or by copy-paste of the public-key file contents:
You can now send us the **public** key (`id_ed25519.pub`), either as a file or by copy-paste of the publickey file contents: