File size: 2,366 Bytes
292d92c |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 |
---
description: Review installed SSH key pairs and delete old ones if desired
tags: [ssh, security, keys, configuration, project, gitignored]
---
You are helping the user manage their SSH keys.
## Process
1. **List SSH keys**
- List keys in `~/.ssh/`: `ls -la ~/.ssh/`
- Identify key pairs:
- Private keys (no extension, or `.pem`)
- Public keys (`.pub`)
- Known hosts file
- Config file
2. **Display public keys with details**
- For each public key:
```bash
for key in ~/.ssh/*.pub; do
echo "=== $key ==="
ssh-keygen -l -f "$key"
echo ""
done
```
- Shows: key length, fingerprint, comment
3. **Check if keys are loaded in ssh-agent**
- List loaded keys: `ssh-add -l`
- If agent not running: `eval "$(ssh-agent -s)"`
4. **Identify key usage**
- Check `~/.ssh/config` for key assignments
- Ask user about each key:
- Where is it used? (GitHub, servers, etc.)
- Is it still needed?
- When was it created?
5. **Check key security**
- Verify key types (RSA, ED25519, etc.)
- Check key lengths:
- RSA: Minimum 2048-bit, prefer 4096-bit
- ED25519: 256-bit (modern, recommended)
- Suggest upgrading old/weak keys
6. **Delete old/unused keys**
- For each key user wants to remove:
```bash
rm ~/.ssh/old_key
rm ~/.ssh/old_key.pub
```
- Update `~/.ssh/config` if key was referenced
- Remove from ssh-agent: `ssh-add -d ~/.ssh/old_key`
7. **Generate new keys if needed**
- Suggest ED25519 for new keys:
```bash
ssh-keygen -t ed25519 -C "user@email.com"
```
- Or RSA 4096:
```bash
ssh-keygen -t rsa -b 4096 -C "user@email.com"
```
8. **Update permissions**
- Ensure correct permissions:
```bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_*
chmod 644 ~/.ssh/id_*.pub
chmod 600 ~/.ssh/config
```
9. **Add keys to ssh-agent**
- Add keys: `ssh-add ~/.ssh/id_ed25519`
- Persist across reboots (add to `~/.bashrc`):
```bash
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
```
## Output
Provide a summary showing:
- List of SSH keys with details (type, length, fingerprint)
- Keys currently loaded in ssh-agent
- Keys deleted (if any)
- New keys generated (if any)
- Security recommendations
- Next steps for adding keys to services
|