SSH Cheatsheet
Keys
Use this SSH reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.
Key Types at a Glance
| Algorithm | Flag | Recommended? | Notes |
|---|---|---|---|
| Ed25519 | ed25519 | Yes — default choice | Fast, small keys, strong security |
| ECDSA | ecdsa | Acceptable | Curve P-256/384/521 |
| RSA | rsa | Only if needed | Use ≥4096 bits; legacy compat |
| DSA | dsa | No | Broken, removed in OpenSSH 9+ |
Generate a Key Pair
# Ed25519 (recommended) ssh-keygen -t ed25519 -C "pablo@example.com" # Ed25519 with custom path ssh-keygen -t ed25519 -f ~/.ssh/github_ed25519 -C "github key" # RSA 4096 (legacy compat) ssh-keygen -t rsa -b 4096 -C "pablo@example.com" # No passphrase (automation / CI — be careful) ssh-keygen -t ed25519 -N "" -f ~/.ssh/deploy_key
-C sets the comment field in the public key (cosmetic). -N "" sets an empty passphrase.
Key Files
~/.ssh/id_ed25519 # private key — NEVER share ~/.ssh/id_ed25519.pub # public key — share freely
The public key is one line:
ssh-ed25519 AAAA...base64... pablo@example.com
Inspect Keys
# Show fingerprint of a public key ssh-keygen -lf ~/.ssh/id_ed25519.pub # Show fingerprint as randomart ssh-keygen -lvf ~/.ssh/id_ed25519.pub # Show the public key of a private key ssh-keygen -yf ~/.ssh/id_ed25519 # Check what key type a file is ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
Change or Remove Passphrase
ssh-keygen -p -f ~/.ssh/id_ed25519
Prompts for old passphrase, then new. Leave new empty to remove it.
Convert and Export
# Export public key in PEM format (for some cloud providers) ssh-keygen -e -m pkcs8 -f ~/.ssh/id_ed25519.pub # Convert OpenSSH private key → PEM (legacy) ssh-keygen -p -m PEM -f ~/.ssh/id_rsa
Host Keys (Server Side)
Generated automatically by sshd on first start; stored in /etc/ssh/.
ls /etc/ssh/ssh_host_* # list host key files ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub # server fingerprint
Regenerate (e.g., after cloning a VM):
sudo rm /etc/ssh/ssh_host_*
sudo ssh-keygen -A # regenerates all host key types
sudo systemctl restart sshd