I need to do the SSH key audit for GitHub, but I am not sure how do find my RSA key fingerprint. I originally followed a guide to generate an SSH key on Linux.
What is the command I need to enter to find my current RSA key fingerprint?
Run the following command to retrieve the SHA256 fingerprint of your SSH key (-l means "list" instead of create a new key, -f means "filename"):
$ ssh-keygen -lf /path/to/ssh/key
So for example, on my machine the command I ran was (using RSA public key):
$ ssh-keygen -lf ~/.ssh/id_rsa.pub
2048 00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff /Users/username/.ssh/id_rsa.pub (RSA)
To get the GitHub (MD5) fingerprint format with newer versions of ssh-keygen, run:
$ ssh-keygen -E md5 -lf <fileName>
Bonus information:
ssh-keygen -lf also works on known_hosts and authorized_keys files.
To find most public keys on Linux/Unix/OS X systems, run
$ find /etc/ssh /home/*/.ssh /Users/*/.ssh -name '*.pub' -o -name 'authorized_keys' -o -name 'known_hosts'
(If you want to see inside other users' homedirs, you'll have to be root or sudo.)
The ssh-add -l is very similar, but lists the fingerprints of keys added to your agent. (OS X users take note that magic passwordless SSH via Keychain is not the same as using ssh-agent.)
The newer SSH commands will list fingerprints as a SHA256 Key.
For example:
ssh-keygen -lf ~/.ssh/id_dsa.pub
1024 SHA256:19n6fkdz0qqmowiBy6XEaA87EuG/jgWUr44ZSBhJl6Y (DSA)
If you need to compare it against an old fingerprint you also need to specify to use the MD5 fingerprint hashing function.
ssh-keygen -E md5 -lf ~/.ssh/id_dsa.pub
2048 MD5:4d:5b:97:19:8c:fe:06:f0:29:e7:f5:96:77:cb:3c:71 (DSA)
Also available: -E sha1
Update... YES...yes... I know... DSA keys for SSH should no longer be used, the older RSA key or newer ecliptic keys should be used instead.
To those 'admins' that keep editing the command I used in the above. STOP CHANGING IT! You make the command and resulting output mis-match!
To see your key on Ubuntu, just enter the following command on your terminal:
ssh-add -l
You will get an output like this:
2568 0j:20:4b:88:a7:9t:wd:19:f0:d4:4y:9g:27:cf:97:23 yourName#ubuntu (RSA)
If however you get an error like; Could not open a connection to your authentication agent.
Then it means that ssh-agent is not running. You can start/run it with:
ssh-agent bash (thanks to #Richard in the comments) and then re-run ssh-add -l
A key pair (the private and public keys) will have the same fingerprint; so in the case you can't remember which private key belong to which public key, find the match by comparing their fingerprints.
The most voted answer by Marvin Vinto provides the fingerprint of a public SSH key file. The fingerprint of the corresponding private SSH key can also be queried, but it requires a longer series of step, as shown below.
Load the SSH agent, if you haven't done so. The easiest way is to invoke
$ ssh-agent bash
or
$ ssh-agent tcsh
(or another shell you use).
Load the private key you want to test:
$ ssh-add /path/to/your-ssh-private-key
You will be asked to enter the passphrase if the key is password-protected.
Now, as others have said, type
$ ssh-add -l
1024 fd:bc:8a:81:58:8f:2c:78:86:a2:cf:02:40:7d:9d:3c you#yourhost (DSA)
fd:bc:... is the fingerprint you are after. If there are multiple keys, multiple lines will be printed, and the last line contains the fingerprint of the last loaded key.
If you want to stop the agent (i.e., if you invoked step 1 above), then simply type `exit' on the shell, and you'll be back on the shell prior to the loading of ssh agent.
I do not add new information, but hopefully this answer is clear to users of all levels.
Reproducing content from AWS forums here, because I found it useful to my use case - I wanted to check which of my keys matched ones I had imported into AWS
openssl pkey -in ~/.ssh/ec2/primary.pem -pubout -outform DER | openssl md5 -c
Where:
primary.pem is the private key to check
Note that this gives a different fingerprint from the one computed by ssh-keygen.
The fastest way if your keys are in an SSH agent:
$ ssh-add -L | ssh-keygen -E md5 -lf /dev/stdin
Each key in the agent will be printed as:
4096 MD5:8f:c9:dc:40:ec:9e:dc:65:74:f7:20:c1:29:d1:e8:5a /Users/cmcginty/.ssh/id_rsa (RSA)
$ ssh-add -l
will also work on Mac OS X v10.8 (Mountain Lion) - v10.10 (Yosemite).
It also supports the option -E to specify the fingerprint format so in case MD5 is needed (it's often used, e.g. by GitHub), just add -E md5 to the command.
On Windows, if you're running PuTTY/Pageant, the fingerprint is listed when you load your PuTTY (.ppk) key into Pageant. It is pretty useful in case you forget which one you're using.
This is the shell function I use to get my SSH key finger print for creating DigitalOcean droplets:
fingerprint() {
pubkeypath="$1"
ssh-keygen -E md5 -lf "$pubkeypath" | awk '{ print $2 }' | cut -c 5-
}
Put it in your ~/.bashrc, source it, and then you can get the finger print as so:
$ fingerprint ~/.ssh/id_rsa.pub
d2:47:0a:87:30:a0:c0:df:6b:42:19:55:b4:f3:09:b9
Sometimes you can have a bunch of keys in your ~/.ssh directory, and don't know which matches the fingerprint shown by GitHub/Gitlab/etc.
Here's how to show the key filenames and MD5 fingerprints of all the keys in your ~/.ssh directory:
cd ~/.ssh
find . -type f -exec printf "\n{}\n" \; -exec ssh-keygen -E md5 -lf {} \;
(For what the parameters mean, refer to this answer about the find command.
Note that the private/public files that belong to one key have the same fingerprint, so you'll see duplicates.
If your SSH agent is running, it is
ssh-add -l
to list RSA fingerprints of all identities, or -L for listing public keys.
If your agent is not running, try:
ssh-agent sh -c 'ssh-add; ssh-add -l'
And for your public keys:
ssh-agent sh -c 'ssh-add; ssh-add -L'
If you get the message: 'The agent has no identities.', then you have to generate your RSA key by ssh-keygen first.
Google Compute Engine shows the SSH host key fingerprint in the serial output of a Linux instance. The API can get that data from GCE, and there is no need to log in to the instance.
I didn't find it anywhere else but from the serial output. I think the fingerprint should be in some more programmer-friendly place.
However, it seems that it depends on the type of an instance. I am using instances of Debian 7 (Wheezy) f1-micro.
If you need to obtain that from the private key do it:
ssh-keygen -y -f key > key.pub && ssh-keygen -lf key.pub
To check a remote SSH server prior to the first connection, you can give a look at www.server-stats.net/ssh/ to see all SHH keys for the server, as well as from when the key is known.
That's not like an SSL certificate, but definitely a must-do before connecting to any SSH server for the first time.
On Fedora I do locate ~/.ssh which tells me keys are at
/root/.ssh
/root/.ssh/authorized_keys
Related
Looking at the fingerprints on github and of my public ssh key they have different formats (e.g. colon separator) and differ
Github
a6:f2:09:40...etc
As generated by: ssh-keygen -lf ~/.ssh/key.pub
4096 SHA256:neLNT0...etc
I can login so can anyone explain what I'm missing?
The current OpenSSH is using SHA256 hashes instead of the ancient MD5 you expect on the first line of your code. To get the legacy fingerprint, there is the -E switch to select a hash algorithm:
ssh-keygen -E md5 -lf ~/.ssh/key.pub
I'm using private keys for downloading my repository from Github in my Docker file. I have something like this:
RUN mkdir -p /root/.ssh && echo "$MY_PRIVATE_KEY" >/root/.ssh/id_rsa && chmod 0600 /root/.ssh/id_rsa && ssh-keyscan github.com >> /root/.ssh/known_hosts && cat /root/.ssh/known_hosts && ssh -vvv git#github.com && pip install git+ssh://git#github.com/my_project.git#v1.0.0 && rm /root/.ssh/id_rsa
Where MY_PRIVATE_KEY is an argument. I'm not able to re-create this key.
My issue is that during connection process I'm getting the following error:
key_load_private_type: incorrect passphrase supplied to decrypt private key
Is it possible to skip passphrase somehow?
The passphrase is required to decrypt the key. You can't "skip" it. You could remove the passphrase on the key using ssh-keygen -p (see the man page for details).
You may want to investigate the use of a GitHub Deploy Key, which is a per-repository ssh key that grants read-only access to the repository. These are meant to solve exactly the situation you find yourself in: needing to automaticaly deploy software from a GitHub repository that requires authentication.
Your MY_PRIVATE_KEY seems to be passphrase-protected (a key with an empty passphrase is not the same as a non-encrypted key).
The key in .ssh/id_rsa is normally not passphrase-protected, instead it is protected by permissions to allow only owner access (0600).
You can remove the passphrase from your key using OpenSSL like this:
set MY_PRIVATE_KEY = `echo $MY_PRIVATE_KEY | openssl rsa`
The contents of id_rsa should look like:
-----BEGIN RSA PRIVATE KEY-----
. . .
-----END RSA PRIVATE KEY-----
I had the similar issue and it turns out the reason is the ssh key was copied differently due to the Makefile
I needed to get the fingerprint of a ssh key using:
$ ssh-keygen -lf ~/.ssh/id_rsa_user.pub
after typing:ssh-keygen -lf ~/.ss TAB It was not giving any options.
I had to do:
$ compdef _files ssh-keygen
After that I was available to autocomplete using the files path, but the command autocomplete stop working, so if if I type ssh-keygen - Tab I don't see any more this output:
$ ssh-keygen -
-- option --
-B -- show the bubblebabble digest of key
-C -- provide new comment
-D -- download key stored in smartcard reader
-N -- provide new passphrase
-P -- provide old passphrase
-U -- upload key to smartcard reader
-b -- specify number of bits in key
-c -- change comment in private and public key files
-e -- export key to SECSH file format
-f -- key file
-i -- import key to OpenSSH format
-l -- show fingerprint of key file
-p -- change passphrase of private key file
-q -- silence ssh-keygen
-t -- specify the type of the key to create
-y -- get public key from private key
So wondering if there is a way of having both options enabled so that I can do something like:
ssh-keyg TAB that will give me:
$ ssh-keygen
Then I can do
$ ssh-keygen - TAB
That would print the option menu and been available to do:
$ ssh-keygen -lf ~/.ss TAB
And have list of options what could work so at the end I would get something like:
$ ssh-keygen -lf ~/.ssh/id_rsa_user.pub
For now I just add to my ~/.zshrc this:
compdef _files ssh-keygen
compdef _files adb
compdef _files mysql
...
But I have to do that for avery command I want to use the _files completion, therefore I would like to know if there is a way to always use _files or failover to it.
Any ideas?
Could it be possible to make it behave like csh in where pressing Ctrl+d shows files options?
Update:
I notice that if I the last argument is an -f the autocomplete works:
ssh-keygen -l -f ~/.sshTAB
But for custom scripts, commands what function, widget alias could help do force the _files completion.?
The solution was to update to zsh this is how I did it:
# check the zsh info
brew info zsh
# install zsh
brew install zsh
# add shell path
sudo vim /etc/shells
# add the following line into the very end of the file(/etc/shells)
/usr/local/bin/zsh
# change default shell
chsh -s /usr/local/bin/zsh
I had issues completing git-flow this was fixed by reinstalling with --without-completions:
$ brew install git --without-completions
I'm trying to setup a GitHub account and every time I get to the point of entering a passphrase for my SSH key my terminal freezes. Here are my steps:
Parkers-MacBook-Pro:~ ppreyer$ ssh-keygen -t rsa -C Parker.preyer1#gmail.com
Generating public/private rsa key pair.
Enter file in which to save the key (/Users/ppreyer/.ssh/id_rsa): (/Users/ppreyer/.ssh/id_rsa):
Created directory '/Users/ppreyer/.ssh'.
Enter passphrase (empty for no passphrase): (WONT LET ME TYPE ANYTHING)
Anybody else run into this problem?
You're on a unix compliant machine. Therefore, most terminal-based password entry mechanisms use what's called a "Unix password field" (as far as I know, that's the most common name for it). You do not actually see the characters you are typing, but they are there. Simply make sure you type the same thing twice and you should be good.
Give it a try, type your password and press Enter. Type it again and press Enter again. You've just create an SSH passphrase.
I agree with MaxMackie's answer (upvoted), but I also like to generate my ssh keys non-interactively:
[space]ssh-keygen -t rsa -f "${H}/.ssh/myKey" -C "Gitolite Admin access (not interactive)" -q -P "xxxx"
That generates a 'mykey' private ssh key and a 'mykey.pub' public ssh key in my ~/.ssh directory.
Note the space before the command, in order to avoid, in my bash session, to record that command in the bash history (because I have defined a HISTCONTROL=ignorespace as in "Execute a terminal command without saving it to .bash_history on OS X?")
I need to encrypt an XML file with a x509 certificate on one computer and be able to decrypt it with the same certificate on another computer. It doesn't seem to work for me like Microsoft suggests:
http://msdn.microsoft.com/en-us/library/ms229744.aspx
The decryption process always fails on another computer!
I create a certificate by using the following command:
makecert -r -pe -n "CN=DEEP_201X" -b 01/01/2011 -e 01/01/2014 -sky exchange -ss my deep.cer
Then I install it by using:
certmgr /add deep.cer /s root
And try to get its private key with the FindPrivateKey.exe utility:
FindPrivateKey My CurrentUser -n "CN=DEEP_201X"
Works great. However, when I perform all the same actions to install the certificate on another computer FindPrivateKey will fail with
No certificates with key 'CN=DEEP_201X' found in the store.
when I use
certmgr /add deep.cer /s my
the error message will be like this:
Unable to obtain private key file name
Could someone please give me a piece of advice on how to make it work?
I suspect that you only need the private key on the decrypting computer.
However...
If you really need the private key on both computers, be aware that The .cer file does not include the private key.
(I think) makecert adds it to the local machine when it generates the cert. You can write it out using the -sv option. Then build a pfx container for the certificate that contains it.
makecert -r -pe -sv myprivatekey.pvk -n "CN=DEEP_201X" -b 01/01/2011 -e 01/01/2014 -sky exchange -ss my deep.cer
pvk2pfx -pvk myprivatekey.pvk -spc deep.cr -pfx deep_private.pfx
I haven't been able to convince certmgr to import private keys from the commandline. Use it in gui mode or use the certmgr.msc snap-in.