Command Line Utility For Generating Key Pairs

An SSH key is a form of authentication in the SSH protocol. It is similar to a password, but allows for authentication without entering in a password or any manual input. SSH keys generally speaking are more secure, and convenient than password authentication.

Creating a Key Pair. Instances use an SSH key pair instead of a password to authenticate a remote user. A key pair file contains a private key and public key. You keep the private key on your computer and provide the public key every time you launch an instance. Jun 26, 2019 To set up SSH key authentication for one of your server’s users, add your public key to a new line inside the user’s authorizedkeys file. This file is stored inside a directory named.ssh/ under the user’s home folder. A user’s authorizedkeys file can store more than one public key, and each public key is listed on its own line.

Command Line Utility¶ This cli interface allows a user to: generate and serialize key pairs (of different key sizes) encrypt and serialize given a public key and a plaintext number; decrypt given a private key and the ciphertext; add two encrypted numbers together; add an encrypted number to a plaintext number.
Jun 06, 2016 This video is part of the Udacity course 'Configuring Linux Web Servers'. Watch the full course at https://www.udacity.com/course/ud299.

Use public key cryptography pairs to encrypt and decrypt login information for your Amazon EC2 instance. And delete tags using the new console and the command line tools. To view, add, or delete a tag for an existing key pair. To use the fsck utility to. Name certutil — Manage keys and certificate in the the NSS database. Synopsis certutil options arguments Description The Certificate Database Tool, certutil, is a command-line utility that can create and modify certificate and key database files. It can also list, generate, modify, or delete certificates within the database, create or change the password, generate new public and private. How to: Create a public-private key pair.; 2 minutes to read; In this article. To sign an assembly with a strong name, you must have a public/private key pair. This public and private cryptographic key pair is used during compilation to create a strong-named assembly. You can create a key pair using the Strong Name tool (Sn.exe).

Command Line

If you currently have access to SSH on your server, you can generate SSH keys on the command line using the ssh-keygen utility which is installed by default on our servers. Run it on your server with no options, or arguments to generate a 2048-bit RSA key pair (which is plenty secure).

You will be prompted to select a file for the key pair. The default directory for SSH keys is ~/.ssh with the private key named id_rsa and the public key named id_rsa.pub. By using the default file names, the SSH client will be able to automatically locate the keys during authentication so it is strongly recommended to not change them. You can use the default by pressing the Enter key.

If /home/USER/.ssh/id_rsa or a key of the name you chose already exists, you will be prompted to overwrite the keys. If you do overwrite the existing keys, you will not be able to use them to authenticate anymore.

After you have selected the file for the key pair, you be will be prompted to enter a passphrase to encrypt private key file. Encrypting the private key with a passphrase is optional, but it will improve security the keys. If you enter a passphrase you will have to provide each it time you use the key. You can press the Enter key to not use a passphrase; we strongly recommend the use of a passphrase with SSH keys.

A public and private key will now be generated.

WHM

Command Line Utility For Generating Key Pairs Free

You can generate SSH key pairs for root in WHM >> Home Security Center >> Manage root's SSH Keys.

Click Generate a New Key to get started.

There are several fields on this page: Key Name, Key Password, Key Type, and Key Size.

The default Key Name is id_rsa. Keys are generated in /root/.ssh/ so the default key name would create a private key in /root/.ssh/id_rsa, and a public key in /root/.ssh/id_rsa.pub. Using the default name will allow SSH clients to automatically locate the keys so it is strongly recommend you use the default name (simply leave the field blank or fill it with id_rsa).

The Key Password encrypts the private key file using a password to add an extra layer of security. The password must be provided each time the key is used for authentication to decrypt the private key. The Password Strength field indicates how strong your password is. 0 indicates a very weak password, and 100 indicates a very strong password. Click Password Generator to have a strong password generated for you.

Key Type and Key Size are RSA and 2048 by default, and are secure enough for most purposes so these can be left alone.

Click Generate Key to generate the SSH key pair. WHM will then display the location of the key.

PuTTY

PuTTY is an open Windows SSH client. You will need to have the PuTTYgen utility installed to generate an SSH key pair. PuTTYgen is included in Windows installer on the Download PuTTY site, but you can download it separately if you installed PuTTY without its extra utilities. See Connect using Putty to a Linux Server to learn more about PuTTY.

Open PuTTYgen.

The Parameters at the bottom can be adjusted to affect how secure the key is, but the default options are plenty secure for most purposes.

If you're satisfied with the parameters, click Generate in Actions to generate the key pair.

You may be asked to 'generate some randomness by moving the mouse over the blank area' to generate the key. The randomness is used to generate your keys securely, and make it difficult to reproduce them.

Once the key is generated, you will see the public key in PuTTYgen.

The Key passphrase field sets a password used to decrypt the private the key. This field is optional, and the private key will not be encrypted if it is omitted.Using a passphrase increases the security of your SSH keys, and we strongly recommend setting one.

Be sure to save both the public and private keys on your local machine so they can be used by PuTTY for authentication in the future by clicking the Save public key and Save private key buttons.

If you don't use a passphrase, it will prompt you to confirm before allowing you to save the private key. The private key will be saved as a .ppk file. The public key isn't given an extension by default, but .pub is a common extension for public key files. It can be saved as a .txt file as well as the public key file only stores the public key in plain text.

Command Line

If you currently have access to SSH on your server, you can upload the key over the command line.

Retrieve the contents of the public key. If the key was created in the default location, this can be done by outputting the contents of ~/.ssh/id_rsa.pub.

The output will look similar to the following:

Open the (and create if it doesn't exist) ~/.ssh/authorized_keys file using a text editor such as nano, pico, or vim.

If you had to create the ~/.ssh/ directory, or the authorized_keys file, you need to verify the permissions are correct, or you won't be able to login.

Paste the public key at the bottom of the file, and then save and close the file.

Alternatively, you can append the public key to ~/.ssh/authorized_keysVideo converter ultimate mac download. with a single command.

You can use the cat command if the public key is stored in a file.

If the public key is not stored as a file on the server, you can use the echo command.

Be sure to include the entire public key in quotes after echo.

Once the public key is added to the authorized_keys file, you should be able to login using your SSH keys.

WHM

You can import an existing SSH key for root in WHM >> Home Security Center >> Manage root's SSH Keys.

Click Import Key.

The next page has a few fields to fill in.

You need to name the SSH key in the Choose a name for this key field. The default key name is id_rsa. Using the default name will allow SSH clients to automatically locate the keys so it is strongly recommend you use the default name (simply leave the field blank or fill it with id_rsa).

If you are importing a PPK (PuTTYgen key) file, enter its password (if applicable) in the Private key passphrase text box.

Paste the public key into the appropriate box, but do not paste the private key into the box; private keys should always remain on the servers that generated them.

Click Import.

WHM will display the name of the keys imported, and you should now be able to authenticate over SSH using the key.

The default name for SSH key pairs is id_rsa, and that name will allow an SSH client to locate the key automatically. When an SSH key pair doesn't use the default name, you will need to specify the name of key used.

Chapter 12 Key Database Tool
Key Database Tool is a command-line utility that can modify the key database file (key3.db) of iPlanet Certificate Management Server (CMS). You can use the utility to create or change the database password, generate new public and private key pairs, display the contents of the database, or delete key pairs from the database.

Key database management tasks are part of a process that typically also involves managing client certificate databases (cert7.dbfile). The key and certificate management process generally begins with creating keys in the key database, then generating and managing certificates in the certificate database.

This chapter discusses key database management. For information on certificate database and security module database management, see Chapter 11 'Certificate Database Tool' and Chapter 16 'Security Module Database Tool.'

This chapter has the following sections:

Availability
Syntax
Usage
Examples

Availability
This tool is available for AIX 4.3, OSF/1 v4.0D, Solaris 2.6 (SunOS 5.6),
Solaris 8, and Windows NT 4.0.

Syntax

To run Key Database Tool, type the command

keyutiloption [arguments]

where option and arguments are combinations of the options and arguments listed in the following section. Each command takes one option. Each option may take zero or more arguments. To see a usage string, issue the command without options, or with the -H option.

Options and Arguments
Options specify an action and are uppercase. Option arguments modify an action and are lowercase. Key Database Tool options and their arguments are defined as follows:

Table 12-1 Description of options and arguments

Option	Description
-N	Create a new key database and set its password. Use the -htokenname argument to specify a specific hardware or software token in which to create the new database.
-C	Change the password to a key database.
-G	Generate a new public and private key pair within a database. The key database should already exist; if one is not present, this option will initialize one by default. Some smart cards (for example, the Litronic card) can store only one key pair. If you create a new key pair for such a card, the previous pair is overwritten.
-L	List the keyID of keys in the key database. A keyID is the modulus of the RSA key or the publicValue of the DSA key. IDs are displayed in hexadecimal ('0x' is not shown). You can identify keys by a shortkeyID. The shortkeyID is the first few bytes of the keyID, starting from the second byte, with a length sufficient to identify it uniquely. Use the -a argument to list keys of all tokens. Otherwise the list will contain only keys in the default (internal) slot. Use the -l argument to list DSA as well as RSA keys.
-P	Display public key information on the screen.
-D	Delete a private key from a key database. Specify the key to delete with the -k argument. Specify the database from which to delete the key with the -d argument. Use the -t argument to specify explicitly whether to delete a DSA or an RSA key. If you do not use the -t argument, the option looks for an RSA key matching the shortkeyID. When you delete keys, be sure to also remove any certificates associated with those keys from the certificate database, by using the Certificate Database Tool. Some smart cards (for example, the Litronic card) do not let you remove a public key you have generated. In such a case, only the private key is deleted from the key pair. You can display the public key with the command keyutil -L -htokenname.
-H	Display a list of the options and arguments used by Key Database Tool.
Argument	Description
-a	List the RSA keys of all tokens when listing keys in the database.
-d keydir	Specify a directory containing a key database file. On Unix Key Database Tool defaults to $HOME/.netscape (that is, ~/.netscape), and on Windows NT the default is the current directory. The key3.db and cert7.db database files must reside in the same directory.
-e exp	Set an alternate exponent value to use in generating a new RSA public key for the database, instead of the default value of 65537. The available alternate values are 3 and 17.
-f noise-file	Read a seed value from the specified binary file to use in generating a new RSA private and public key pair. This argument makes it possible to use hardware-generated seed values and unnecessary to manually create a value from the keyboard. The minimum file size is 20 bytes.
-h tokenname	Specify the name of a token to act on. Unless otherwise specified, the default token is an internal slot (specifically, internal slot 2). An internal slot is a virtual slot maintained in software, rather than a hardware device. Internal slot 2 is used by key and certificate services. Internal slot 1 is used by cryptographic services. Use the Module Database Tool (modutil -list) to get a list of token names in the module database.
-k shortkeyID	Specify a private key by using the key identifier. You can use the complete keyID (as shown by the -L option), or the shortkeyID. The shortkeyID is the first few bytes of the keyID, starting from the second byte, with a length sufficient to identify it uniquely. If you specify a shortkeyID that is not unique, the first private key that matches the shortkeyID is found.
-l	List DSA as well as RSA keys when listing keys in the key database.
-q pqgfile	Read an alternate PQG value from the specified file when generating DSA key pairs. If this argument is not used, Key Database Tool generates its own PQG value. PQG files are created with a separate DSA utility.
-s size	Set a key size to use when generating new public and private key pairs. The minimum is 256 bits and the maximum is 1024 bits. The default is 1024 bits. Any size between the minimum and maximum is allowed.
-t rsa dsa	Specify the type of a key, either RSA or DSA. The default value is rsa. By specifying the type of key you can avoid mistakes caused by duplicate shortkeyIDs.
Bitcoin public and private key generator. -w password-file	Specify a file to automatically supply the password necessary to access a key database. This is a plain-text file containing one password. You should not use this argument if you are accessing an internal slot and hardware tokens that use different passwords. Be sure to prevent unauthorized access to this file.

Usage

Key Database Tool's capabilities are grouped as follows, using these combinations of options and arguments. The specifications in square brackets are optional, those without square brackets are required.

Creating a new key3.db file and setting its password:
-N [-d keydir] [-w password-file]
Changing the password to a key database file:
-C [-d keydir]
Generating new RSA key pairs in a key database file:
-G [-h tokenname] [-t rsa] [-snum] [-e exp] [-d keydir]
[-f noise-file] [-w password-file]
Generating new DSA key pairs in a key database file:
-G [-h tokenname] -t dsa [-q pqgfile -s num]
[-d keydir] [-w password-file]
Listing the keyIDs of the keys in a database:
-L [-a] [-l] [-t rsa dsa] [-h tokenname] [-d keydir]
Displaying public key information from the database:
-P -k shortkeyID [-t rsa dsa] [-h tokenname]
[-d keydir] [-w password-file]
Deleting private keys from a key database file:
-D -k shortkeyID [-t rsa dsa] [-h tokenname]
[-d keydir] [-w password-file]
Displaying a list of the options and arguments used by Key Database Tool:
-H

Examples
Includes the following:

Creating a Key Database
Generating a New Key
Displaying Public Key Information
Listing Key IDs
Deleting a Private Key

Creating a Key Database
This example creates new key database files (key3.dband secmod.db) in the specified directory:

keyutil -N -d keydir

Key Database Tool prompts you as follows:

Creating a brand new key database:keydir/key3.db
Database not initialized. Setting password.
Enter new password:
Re-enter password:

After you enter the password, Key Database Tool creates new key3.db and secmod.db files in the specified directory.

Generating a New Key
This example generates a new key in a key database:

keyutil -G -d keydir

Key Database Tool then displays the following:

----------------------------------------------------
Netscape Communications Corporation
Key Generation
--------------------------------------------------------

Welcome to the key generator. With this program, you can
generate the public and private keys that you use for secure
communications.

A random seed must be generated that will be used in the
creation of your key. One of the easiest ways to create a random
seed is to use the timing of keystrokes on a keyboard.

You have specified the name 'mykey' for your key

If this is correct, press enter:

To begin, type keys on the keyboard until this progress meter is
full. DO NOT USE THE AUTOREPEAT FUNCTION ON YOUR KEYBOARD!

Continue typing until the progress meter is full:

************************************************************

Finished. Press enter to continue:

Generating key. This may take a few moments.

Password:

generated public/private key pair

Note that if you do not specify a token name, the key is generated on the internal slot. This is equivalent to the -h internal argument.

If you use the -fnoise-file argument, Key Database Tool does not ask for keyboard input.

If you use the -wpassword-file argument, Key Database Tool reads the password from the file instead of asking for keyboard input. Avoid using this argument when you are accessing both the internal slot and tokens that have different passwords.

Displaying Public Key Information
This example prints the public key's information:

keyutil -P -k e95c -d keydir

The public key information appears after you give the correct password:

Command Line Utility For Generating Key Pairs

Password:

It's the first key found.
RSA Public-Key:
modulus:
00:e9:5c:4a:73:74:39:22:6d:c6:da:4e:b3:1f:01:26:9d:be:
d1:74:ae:cd:c7:7d:65:f9:1d:31:1f:71:fb:60:d0:45:46:5f:
5a:19:e7:61:1e:e7:ce:9f:4a:13:4e:d6:e9:06:90:2a:ba:bd:
0b:5f:7b:a3:28:21:1e:0f:1c:f4:3a:ba:3a:8f:0b:e1:99:91:
cc:e8:fd:17:d2:1c:66:13:6b:95:27:b1:eb:bc:9c:e6:7b:f0:
3a:b9:44:dc:24:a6:f8:83:9a:9e:80:3f:74:48:09:6b:3f:a6:
46:51:be:e0:1b:51:87:8c:44:94:f0:fe:41:fe:b4:9f:4c:0a:
04:a9:a1
publicExponent: 65537 (0x10001)

Listing Key IDs
This command lists the key IDs in the key database:

keyutil -L -d keydir

After you enter the password, Key Database Tool displays the following:

RSA Public-Key:
modulus:
00:e9:5c:4a:73:74:39:22:6d:c6:da:4e:b3:1f:01:26:9d:be:
d1:74:ae:cd:c7:7d:65:f9:1d:31:1f:71:fb:60:d0:45:46:5f:
5a:19:e7:61:1e:e7:ce:9f:4a:13:4e:d6:e9:06:90:2a:ba:bd:
0b:5f:7b:a3:28:21:1e:0f:1c:f4:3a:ba:3a:8f:0b:e1:99:91:
cc:e8:fd:17:d2:1c:66:13:6b:95:27:b1:eb:bc:9c:e6:7b:f0:
3a:b9:44:dc:24:a6:f8:83:9a:9e:80:3f:74:48:09:6b:3f:a6:
46:51:be:e0:1b:51:87:8c:44:94:f0:fe:41:fe:b4:9f:4c:0a:
04:a9:a1

When unmodified, this command lists all the RSA keys in the default (internal) slot. You can refine this command's output with the -a, -h, and -l arguments.

Command Line Utility For Generating Key Pairs Free

Deleting a Private Key
This example deletes a private key from the key database:

Command Line Utility

keyutil -D -k e95c -d keydir

Command Line Utility For Generating Key Pairs Worksheet

When you delete keys, be sure to remove any certificates associated with those keys from the certificate database by using the Certificate Database Tool.