SSH – How to Recover Public Key from Private SSH Key

key-authenticationssh

I've somehow lost my id_rsa.pub file. I still have my id_rsa file. How do I recover the public key from the private key?

(This question came up after ssh-copy-id was reporting "ERROR: No identities found" while ssh-keygen reported "/root/.ssh/id_rsa already exists". ls ~/.ssh pointed out the problem was having id_rsa but not id_rsa.pub. I found the solution, but it was buried at the bottom of a long post on an Ubuntu support forum.)

Best Answer

You can generate the public key using ssh-keygen -y. If your private key is in the default location, you can use the following to put the public key in the same place:

ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/id_rsa.pub

Related Solutions

Ssh – setting up ssh public key

Check permissions. OpenSSH will not allow public-key authentication if a user's home directory, ~/.ssh, or ~/.ssh/authorized_keys is world writable. Also, ~/.ssh and ~/.ssh/authorized_keys should probably not be group-writable either. Leave IdentityFile at the default, it's has nothing to do with the server aspect. It points to the default private key file used by the ssh client on UNIX/Linux. ssh_config is used only by the ssh client, and not the OpenSSH sshd server. The contents of authorized_keys should be one line per public key that is authorized to log in and look something like this:

ssh-rsa AAA.../Us= My Public Key comment

Where ... is a bunch of base64 characters ([a-zA-Z/+=]). PuTTYGen can generate two forms of keys: PuTTY and OpenSSH compatible. The OpenSSH compatible will be one long line in the above format. If it's in PuTTY format, you can import it back into PuTTYGen and save as OpenSSH.

Ssh – Is it really possible to directly steal a private key if it uses no passphrase

That question is worried about private keys stored on the server unencrypted. It's a scenario like:

workstation 1 ---> gateway -> final server
     ⋮               |
workstation n ------/

and the OP is worried about private keys on "gateway", which is a shared machine with multiple users.

It is not possible to steal the private key by compromising the server, only the machine the key is actually stored on. If you use ssh agent forwarding, then its possible to use the key without stealing it (to log into another machine, for example), if you do not have ssh-agent prompt first.

But you should still encrypt your private keys, in case your workstation is compromised. Or, especially in the case of a laptop, lost or stolen.

Best Answer

Related Solutions

Ssh – setting up ssh public key

Ssh – Is it *really* possible to directly steal a private key if it uses no passphrase

Related Question

Ssh – Is it really possible to directly steal a private key if it uses no passphrase