I have noticed that the ssh-keygen for ubuntu 20.04 is missing the options for generating the Diffie-Hellman parameters. This is normally part of SSH hardening. Does anyone know why it has disappeared?
It seems like this should be easy. I run "ssh-keygen -l -f " (the default seems to be SHA1). All of the examples show it printing the hex-formatted digest with a little extra, harmless information. Yet, on my Mac I'm getting a useless, opaque string.
I should mention that the "-E" parameter works on Mac (10.10) but is unavailable in Ubuntu (14.04). Keep that in mind if it doesn't work for you.
$ ssh-keygen -l -E md5 -f dustin.pem
2048 MD5:29:ed:da:d3:5a:8c:78:4f:62:d3:fd:0c:77:5b:6d:d9 dustin.pem.pub (RSA)
$ ssh-keygen -l -E sha1 -f dustin.pem
2048 SHA1:x2ENPL+vzVdlgkIyu0tAhVQ+H4U dustin.pem.pub (RSA)
$ ssh-keygen -l -E sha256 -f dustin.pem
2048 SHA256:agJs/axI8QPzet/eoPMDxLSf37fd1bgsMX4Di0gqMy4 dustin.pem.pub (RSA)
Both of the attempted SHA algorithms return opaque, but different, ASCII strings.
What am I missing? How do I get a SHA1 hex-digest without having to copy my key to a Linux system to do it?
Thanks.
My private key (~/.ssh/id_rsa) is a 1766-byte file, but my public key (~/.ssh/id_rsa.pub) is only 396 bytes in length. Why the massive difference? Is it because the private key is encrypted using AES? Isn't AES ciphertext usually around the same length as the plaintext?
Possible Duplicate:
SSH keypair generation: RSA or DSA?
Some say use RSA, some say use DSA, some say it doesn't matter.
Some say one is more secure than the other, some say the reverse.
Some say it's a patent issue.
- So, what's the real story here? Pros and cons, etc?
- In the end either will do, but for the fastidious security-minded person, which one is a better fit?
- Should one bother with mandating that the entire company use the same encryption?
Update
Ah, turns out this is an exact dupe of q40071, and the accepted answer there is ok.
I have an existing public/private key pair. The private key is password protected, and the encryption may be either RSA or DSA. These keys are the kind you generate with ssh-keygen and generally store under ~/.ssh.
I'd like to change the private key's password. How do I go about it, on a standard Unix shell?
Also, how do I simply remove the password? Just change it to empty?