Skip to main content

SSH Keys

Git is a distributed version control system, which means you can work locally, then share or push your changes to a server. In this case, the server you push to is Boltic.

Boltic uses the SSH protocol to securely communicate with Git. When you use SSH keys to authenticate to the Boltic remote server, you don’t need to supply your username and password each time.

What are SSH keys​

SSH uses two keys, a public key and a private key.

  • The public key can be distributed.
  • The private key should be protected.

It is not possible to reveal confidential data by uploading your public key. When you need to copy or upload your SSH public key, make sure you do not accidentally copy or upload your private key instead.

For details, see Asymmetric cryptography, also known as public-key cryptography.

Prerequisites​

To use SSH to communicate with Boltic, you need:

  • The OpenSSH client, which comes pre-installed on GNU/Linux, macOS, and Windows 10.
  • SSH version 6.5 or later. Earlier versions used an MD5 signature, which is not secure.

To view the version of SSH installed on your system, run ssh -V.

Supported SSH key types​

To communicate with Boltic, you can use the following SSH key types:

ED25519 SSH keys​

The book Practical Cryptography With Go suggests that ED25519 keys are more secure and performant than RSA keys.

OpenSSH 6.5 introduced ED25519 SSH keys in 2014, and they should be available on most operating systems.

ED25519_SK SSH keys​

To use ED25519_SK SSH keys on Boltic, your local client and Boltic server must have OpenSSH 8.2 or later installed.

ECDSA_SK SSH keys​

To use ECDSA_SK SSH keys on Boltic, your local client and Boltic server must have OpenSSH 8.2 or later installed.

RSA SSH keys​

Available documentation suggests ED25519 is more secure than RSA.

If you use an RSA key, the US National Institute of Standards and Technology in Publication 800-57 Part 3 (PDF) recommends a key size of at least 2048 bits. Due to limitations in Go, RSA keys cannot exceed 8192 bits

The default key size depends on your version of ssh-keygen. Review the man page for your installed ssh-keygen command for details.

See if you have an existing SSH key pair​

Before you create a key pair, see if a key pair already exists.

  1. Go to your home directory.

  2. Go to the .ssh/ subdirectory. If the .ssh/ subdirectory doesn't exist, you are either not in the home directory, or you haven't used ssh before. In the latter case, you need to generate an SSH key pair.

  3. See if a file with one of the following formats exists:

    AlgorithmPublic keyPrivate key
    ED25519 (preferred)id_ed25519.pubid_ed25519
    ED25519_SKid_ed25519_sk.pubid_ed25519_sk
    ECDSA_SKid_ecdsa_sk.pubid_ecdsa_sk
    RSA (at least 2048-bit key size)id_rsa.pubid_rsa
    ECDSAid_ecdsa.pubid_ecdsa

Generate an SSH key pair​

If you do not have an existing SSH key pair, generate a new one:

  1. Open a terminal.

  2. Run ssh-keygen -t followed by the key type and an optional comment. This comment is included in the .pub file that's created. You may want to use an email address for the comment.

    For example, for ED25519:

    ssh-keygen -t ed25519 -C "<comment>"

    For 2048-bit RSA:

    ssh-keygen -t rsa -b 2048 -C "<comment>"

  3. Press Enter. Output similar to the following is displayed:

    Generating public/private ed25519 key pair.
    Enter file in which to save the key (/home/user/.ssh/id_ed25519):

  4. Accept the suggested filename and directory, unless you want to save in a specific directory where you store other keys.

  5. Specify a passphrase:

    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:

    A confirmation is displayed, including information about where your files are stored.

A public and private key are generated. Add the public SSH key to your Boltic account and keep the private key secure.

Configure SSH to point to a different directory​

If you did not save your SSH key pair in the default directory, configure your SSH client to point to the directory where the private key is stored.

  1. Open a terminal and run this command:

    eval $(ssh-agent -s)
    ssh-add <directory to private SSH key>

  2. Save these settings in the ~/.ssh/config file. For example:

    # Boltic.com
    Host ssh.git.boltic.io
      PreferredAuthentications publickey
      IdentityFile SSH_KEY_PATH

Update the SSH_KEY_PATH with the path to your private key created here

For more information on these settings, see the man ssh_config page in the SSH configuration manual.

Public SSH keys must be unique to Boltic because they bind to your account. Your SSH key is the only identifier you have when you push code with SSH. It must uniquely map to a single user.

Update your SSH key passphrase​

You can update the passphrase for your SSH key:

  1. Open a terminal and run this command:

    ssh-keygen -p -f /path/to/ssh_key

  2. At the prompts, enter the passphrase and then press Enter.

Upgrade your RSA key pair to a more secure format​

If your version of OpenSSH is between 6.5 and 7.8, you can save your private RSA SSH keys in a more secure OpenSSH format by opening a terminal and running this command:

ssh-keygen -o -f ~/.ssh/id_rsa

Alternatively, you can generate a new RSA key with the more secure encryption format with the following command:

ssh-keygen -o -t rsa -b 4096 -C "<comment>"

Add an SSH key to your Boltic account​

To use SSH with Boltic, copy your public key to your Boltic account:

  1. Copy the contents of your public key file. You can do this manually or use a script. For example, to copy an ED25519 key to the clipboard:

    macOS

    tr -d '\n' < ~/.ssh/id_ed25519.pub | pbcopy

    Linux (requires the xclip package)

    xclip -sel clip < ~/.ssh/id_ed25519.pub

    Git Bash on Windows

    cat ~/.ssh/id_ed25519.pub | clip

    Replace id_ed25519.pub with your filename. For example, use id_rsa.pub for RSA.

  2. Sign in to Boltic.

  3. On the top bar, select your avatar.

  4. Select Profile.

  5. On the right sidebar, select SSH Keys.

  6. Select New Key.

  7. In the Content box, paste the contents of your public key. If you manually copied the key, make sure you copy the entire key, which starts with ssh-rsa, ssh-dss, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, ssh-ed25519, [email protected], or [email protected], and may end with a comment.

  8. In the Key Name box, type a description, like Work Laptop or Home Workstation.

  9. Select Add SSH key.

Verify that you can connect​

Verify that your SSH key was added correctly.

The following commands use the hostname ssh.git.boltic.io.

  1. Open a terminal and run this command:

    ssh -T [email protected]

  2. If this is the first time you connect, you should verify the authenticity of the Boltic host. If you see a message like:

    The authenticity of host 'ssh.git.boltic.io (34.102.226.145)' can't be established.
    ECDSA key fingerprint is SHA256:HbW3g8zUjNSksFbqTiUWPWg2Bq1x8xdGUrliXFzSnUw.
    Are you sure you want to continue connecting (yes/no)? yes
    Warning: Permanently added 'ssh.git.boltic.io' (ECDSA) to the list of known hosts.

    Type yes and press Enter.

  3. Run the ssh -T [email protected] command again. You should receive a Hi there, @username! You've successfully authenticated with the key named @keyname! message.

If the welcome message doesn't appear, you can troubleshoot by running ssh in verbose mode:

ssh -Tvvv [email protected]

Use different keys for different repositories​

You can use a different key for each repository.

Open a terminal and run this command:

git config core.sshCommand "ssh -o IdentitiesOnly=yes -i ~/.ssh/private-key-filename-for-this-repository -F /dev/null"

This command does not use the SSH Agent and requires Git 2.10 or later. For more information on ssh command options, see the man pages for both ssh and ssh_config.

View your account's SSH keys​

To view the SSH keys for your account:

  1. On the top bar, select your avatar.
  2. Select Profile.
  3. On the right sidebar, select SSH Keys.

Your existing SSH keys are listed at the bottom of the page. The information includes:

  • The key's:
    • Name.
    • Public fingerprint.
    • Creation date.

Delete an SSH key​

To permanently delete an SSH key:

  1. On the top bar, select your avatar.
  2. Select Profile.
  3. On the right sidebar, select SSH Keys.
  4. Next to the key you want to delete, select   Remove   (   remove   )
  5. Select Delete.