Home / server / Questions / 50775
Accepted
kch
Asked: 2009-08-06 21:37:57 +0800 CST

How do I change my private key passphrase?

  • 772

I have an existing public/private key pair. The private key is password protected, and the encryption may be either RSA or DSA. These keys are the kind you generate with ssh-keygen and generally store under ~/.ssh.

I'd like to change the private key's password. How do I go about it, on a standard Unix shell?

Also, how do I simply remove the password? Just change it to empty?

unix ssh ssh-keygen passphrase

3 Answers

  1. Best Answer

    To change the passphrase on your default key:

    $ ssh-keygen -p

    If you need to specify a key, pass the -f option:

    $ ssh-keygen -p -f ~/.ssh/id_dsa

    then provide your old and new passphrase (twice) at the prompts. (Use ~/.ssh/id_rsa if you have an RSA key.)

    More details from man ssh-keygen:

    [...]
SYNOPSIS
    ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment]
               [-f output_keyfile]
    ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
[...]
     -f filename
             Specifies the filename of the key file.
[...]
     -N new_passphrase
             Provides the new passphrase.

     -P passphrase
             Provides the (old) passphrase.

     -p      Requests changing the passphrase of a private key file instead of
             creating a new private key.  The program will prompt for the file
             containing the private key, for the old passphrase, and twice for
             the new passphrase.
[...]
    • 531

  2. If you don't have ssh-keygen installed, you can also use openssl directly

    key="/path/to/your.key"
algo="-des3" # or -aes256 or ...

openssl rsa $algo -in "$key" -out "$key.new"

# and replace old key with new one
mv "$key.new" "$key"
    • 2

  3. Remove your SSH public/private keys:

    rm ~/.ssh/id_rsa*

    Recreate the keypair, choosing a new passphrase:

    ssh-keygen -t rsa -f ~/.ssh/id_rsa

    Add the newly created private key to your OS X Keychain to store the passphrase and manage unlocking it automatically:

    ssh-add -K ~/.ssh/id_rsa

    Copy the public key to the OS X clipboard for adding to web services like GitHub, etc.

    cat ~/.ssh/id_rsa.pub | pbcopy

    Add your newly created public key to the ~/.ssh/authorized_keys file of the remote server. Be sure to ensure the correct permissions of both the remote ~/.ssh folder (700) and ~/.ssh/authorized_keys (600). You may want to investigate using ssh-copy-id to ease this process.

    • -14