SSH Key Management¶

Guide for managing SSH keys with the SSH Tools Suite.

Overview¶

SSH key management is crucial for secure and efficient tunnel connections. This guide covers creating, managing, and using SSH keys with the SSH Tunnel Manager.

SSH Key Types¶

RSA Keys¶

The most common and widely supported key type:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

ED25519 Keys¶

Modern, more secure, and faster:

ssh-keygen -t ed25519 -C "your_email@example.com"

ECDSA Keys¶

Elliptic curve keys, good performance:

ssh-keygen -t ecdsa -b 521 -C "your_email@example.com"

Key Generation¶

Using SSH Tools Suite¶

The SSH Tunnel Manager includes built-in key generation:

Open the SSH Tunnel Manager
Go to Settings → SSH Keys
Click Generate New Key Pair
Choose key type and size
Enter passphrase (recommended)
Save to secure location

Command Line Generation¶

# Generate RSA key
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_tunnels

# Generate ED25519 key
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_tunnels

# Generate with specific comment
ssh-keygen -t ed25519 -C "tunnel-keys-$(date +%Y%m%d)" -f ~/.ssh/id_tunnel

Key Management Best Practices¶

Secure Storage¶

Use passphrases: Always protect private keys with strong passphrases

Restrict permissions: Set proper file permissions

chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub

Separate keys: Use different keys for different purposes
Backup safely: Store backups in encrypted storage

Key Organization¶

~/.ssh/
├── config                    # SSH client configuration
├── id_rsa_work              # Work-related tunnels
├── id_rsa_work.pub
├── id_rsa_personal          # Personal projects
├── id_rsa_personal.pub
├── id_ed25519_servers       # Server management
├── id_ed25519_servers.pub
└── authorized_keys          # Authorized public keys

SSH Configuration¶

Client Configuration (~/.ssh/config)¶

# Work servers
Host work-tunnel
    HostName work.company.com
    User tunnel_user
    IdentityFile ~/.ssh/id_rsa_work
    Port 22

# Personal servers
Host personal-server
    HostName personal.example.com
    User myuser
    IdentityFile ~/.ssh/id_ed25519_personal
    Port 2222

# Development environment
Host dev-*
    User developer
    IdentityFile ~/.ssh/id_rsa_dev
    ForwardAgent yes

Using with SSH Tunnel Manager¶

Configure SSH keys in tunnel profiles:

from ssh_tunnel_manager.core.models import TunnelConfig

config = TunnelConfig(
    name="secure-tunnel",
    ssh_host="server.example.com",
    ssh_port=22,
    ssh_username="user",
    ssh_key_path="~/.ssh/id_ed25519_tunnels",
    ssh_key_passphrase="your_passphrase",
    local_port=8080,
    remote_host="localhost",
    remote_port=80
)

Public Key Deployment¶

Manual Deployment¶

# Copy public key to server
ssh-copy-id -i ~/.ssh/id_rsa.pub user@server.com

# Manual copy
cat ~/.ssh/id_rsa.pub | ssh user@server.com "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Using SSH Tools Suite¶

The tunnel manager can automatically deploy public keys:

Create new tunnel configuration
Enable Auto-deploy public key
Provide initial password for deployment
Future connections will use key authentication

Key Rotation¶

Regular Rotation Schedule¶

Generate new keys quarterly or annually
Deploy new public keys to all servers
Update tunnel configurations with new private keys
Remove old public keys after verification
Securely delete old private keys

Rotation Script Example¶

#!/bin/bash
# Key rotation script

OLD_KEY="~/.ssh/id_rsa_old"
NEW_KEY="~/.ssh/id_rsa_new"

# Generate new key
ssh-keygen -t ed25519 -f "$NEW_KEY"

# Deploy to servers
for server in server1 server2 server3; do
    ssh-copy-id -i "$NEW_KEY.pub" "user@$server"
done

# Update SSH Tunnel Manager configurations
# (This would typically be done through the GUI)

echo "Key rotation complete. Please update tunnel configurations."

Troubleshooting¶

Permission Issues¶

# Fix SSH directory permissions
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_*
chmod 644 ~/.ssh/id_*.pub
chmod 644 ~/.ssh/config

Connection Issues¶

Verify key format:
```
ssh-keygen -y -f ~/.ssh/id_rsa
```

Test key authentication:

ssh -i ~/.ssh/id_rsa -v user@server.com

Check server authorization:

ssh user@server.com "cat ~/.ssh/authorized_keys"

Key Not Working¶

Check SSH agent:
```
ssh-add -l
ssh-add ~/.ssh/id_rsa
```
Verify passphrase:
```
ssh-keygen -y -f ~/.ssh/id_rsa
```
Check server logs:
```
sudo tail -f /var/log/auth.log
```

Security Considerations¶

Key Security¶

Never share private keys
Use strong passphrases
Monitor key usage
Rotate keys regularly
Remove unused keys

Server-Side Security¶

Disable password authentication:

# In /etc/ssh/sshd_config
PasswordAuthentication no
ChallengeResponseAuthentication no

Restrict key types:

PubkeyAcceptedKeyTypes ssh-ed25519,rsa-sha2-512,rsa-sha2-256

Enable key logging:
```
LogLevel VERBOSE
```

Integration with CI/CD¶

Automated Deployments¶

# GitHub Actions example
- name: Setup SSH Key
  uses: webfactory/ssh-agent@v0.5.3
  with:
    ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

- name: Deploy via SSH Tunnel
  run: |
    ssh-tunnel-manager create-tunnel \
      --name "deploy-tunnel" \
      --ssh-host "jump.company.com" \
      --ssh-user "deploy" \
      --local-port 3306 \
      --remote-host "db.internal" \
      --remote-port 3306

Best Practices Summary¶

✅ Use ED25519 keys for new installations
✅ Always use passphrases on private keys
✅ Separate keys by purpose (work, personal, etc.)
✅ Regular rotation schedule (quarterly/annually)
✅ Monitor and audit key usage
✅ Secure backup of key materials
✅ Document key purposes and expiration dates
✅ Remove old/unused keys promptly

This guide ensures secure and efficient SSH key management for your tunnel operations.