Menggenarate publik key menggunakan Putty

Pada Windows

This page is about PuTTYgen on Windows. For the Linux version, see here.

PuTTYgen is an key generator tool for creating SSH keys for PuTTY. It is analogous to the ssh-keygen tool used in some other SSH implementations.

The basic function is to create public and private key pairs. PuTTY stores keys in its own format in .ppk files. However, the tool can also convert keys to and from other formats.

PuTTYgen.exe on Windows is a graphical tool. A command-line version is available for Linux.

Contents

• PuTTYgen download and install
• Running PuTTYgen
• Creating a new key pair for authentication
• Installing the public key as an authorized key on a server
• Managing SSH keys
• Changing the passphase of a key
• Videos illustrating use of PuTTYgen
  • Using PuTTYgen to generate an SSH key
  • How to set up PuTTY SSH keys for passwordless logins using Pagent

PUTTYGEN DOWNLOAD AND INSTALL

PuTTYgen is normally installed as part of the normal PuTTY .msi package installation. There is no need for a separate PuTTYgen download. Download the PuTTY installation package. For detailed installation instructions, see PuTTY installation instructions.

RUNNING PUTTYGEN

Go to Windows Start menu → All Programs → PuTTY→ PuTTYgen.

CREATING A NEW KEY PAIR FOR AUTHENTICATION

To create a new key pair, select the type of key to generate from the bottom of the screen (using SSH-2 RSA with 2048 bit key size is good for most people; another good well-known alternative is ECDSA).

Then click Generate, and start moving the mouse within the Window. Putty uses mouse movements to collect randomness. The exact way you are going to move your mouse cannot be predicted by an external attacker. You may need to move the mouse for some time, depending on the size of your key. As you move it, the green progress bar should advance.

Once the progress bar becomes full, the actual key generation computation takes place. This may take from several seconds to several minutes. When complete, the public key should appear in the Window. You can now specify a passphrase for the key.

You should save at least the private key by clicking Save private key. It may be advisable to also save the public key, though it can be later regenerated by loading the private key (by clicking Load).

We strongly recommended using a passphrase be for private key files intended for interactive use. If keys are needed for automation (e.g., with WinSCP, then they may be left without a passphrase.

INSTALLING THE PUBLIC KEY AS AN AUTHORIZED KEY ON A SERVER

With both Tectia SSH and OpenSSH servers, access to an account is granted by adding the public key to a ~/.ssh/authorized_keys file on the server.

To install the public key, Log into the server, edit the authorized_keys file with your favorite editor, and cut-and-paste the public key output by the above command to the authorized_keys file. Save the file. Configure PuTTY to use your private key file (here keyfile.ppk). Then test if login works. See configuring public key authentication for PuTTY.

MANAGING SSH KEYS

In larger organizations, the number of SSH keys on servers and clients can easily grow to tens of thousands, in some cases to millions of keys. In large quantities, SSH keys can become a massive security risk and they can violate compliance requirements. In the worst case, they could be used to take down a Fortune 500.

The Universal SSH Key Manager can manage PuTTY keys in addition to OpenSSH and Tectia keys. It works with legacy keys on traditional servers as well as dynamic and keyless elastic environments in the cloud. Any larger organization should ensure they have proper provisioning and termination processes for SSH keys as part of their Identify and Access Management (IAM) practice.

CHANGING THE PASSPHASE OF A KEY

It is recommended that all SSH keys be regenerated and changed periodically. The Universal SSH Key Manager can automate this. Just changing the passphrase is no substitute, but it is better than nothing. These instructions can also be used to add a passphrase to a key that was created without one.

To change the passphrase, click on Load to load an existing key, then enter a new passphrase, and click Save private key to save the private key with the new passphrase. Be sure to properly destroy and wipe the old key file. Creating a new file with a new passphrase will not help if the old file remains available.

Pada Linux

This page is about PuTTYgen on Linux. For the Windows version, see the PuTTYgen on Windows page.

Puttygen is the SSH key generation tool for the linux version of PuTTY. It works similarly to the ssh-keygen tool in OpenSSH.

The basic function is to create public and private key pairs. PuTTY stores keys in its own format in .ppk files. However, the tool can also convert key formats.

Contents

• Installation
• Creating a New Key Pair for Authentication
• Installing the Public Key as an Authorized Key on a Server
• Changing the Passphase of a Key
• Exporting a Private Key to Tectia SSH or OpenSSH
• Command Line Options

INSTALLATION

In some Linux distributions, the puttygen tool needs to be installed separately from the Putty client. For example, in Debian Linux, the following command will install it:

sudo aptitude install putty-tools

CREATING A NEW KEY PAIR FOR AUTHENTICATION

To create a new key pair for authentication from the command line, use something like:

puttygen -t rsa -b 2048 -C "user@host" -o keyfile.ppk

It is strongly recommended that a passphrase be used for key files intended for interactive use. Key files used for automation (e.g., with WinSCP should generally have an empty passphrase.

INSTALLING THE PUBLIC KEY AS AN AUTHORIZED KEY ON A SERVER

With both Tectia SSH and OpenSSH servers, access to an account is configured by generating a public key, copying the public key to the server, and adding the public key to a ~/.ssh/authorized_keys file.

To extract the public key, use:

puttygen -L keyfile.ppk

Then log into the server, edit the authorized_keys file with your favorite editor, and cut-and-paste the public key output by the above command to the authorized_keys file. Save the file. Configure PuTTY to use your private key file (here keyfile.ppk). Then test if login works. See configuring public key authentication for PuTTY.

CHANGING THE PASSPHASE OF A KEY

It is recommended that all SSH keys be regenerated and changed periodically. The Universal SSH Key Manager can automate this. Just changing the passphrase is no substitute, but it is better than nothing. These instructions can also be used to add a passphrase to a key that was created without one.

Use the following command to change the passphrase:

puttygen keyfile.ppk -P

This will prompt for the new passphrase, and write the result back to keyfile.ppk with the new passphrase.

EXPORTING A PRIVATE KEY TO TECTIA SSH OR OPENSSH

It is rarely necessary to export a private key from PuTTY to Tectia SSH or OpenSSH. However, the process is described here, as it can sometimes be necessary when, for example, an application is moved to Linux in the cloud and the destination server of a file transfer cannot easily be reconfigured to change an authorized key.

Tectia SSH and OpenSSH both support the OpenSSH private key file format, so using that key file format is described here. Tectia SSH also supports certain other formats.

To convert an existing PuTTY private key for Tectia or OpenSSH, use the command:

puttygen keyfile.ppk -O private-openssh -o keyfile

Then copy keyfile to the .ssh directory on the host where Tectia or OpenSSH will be run.

COMMAND LINE OPTIONS

The basic command line of PuTTYgen:

• Specifies a key file to read or a key type and size to generate.
• Optional action to perform (e.g., change passphrase)
• Optional output type and output file.

The basic command line is:

puttygen [-t keytype [-b bits] [-q] | keyfile]
         [-C new-comment] [-P]
         [-O output-type | -p | -l | -L]
         [-o output-file]

The options are:

keyfile Name of existing key file to read, when modifying an existing key.

-t keytype Specifies to the type of a new key to generate. Acceptable values include rsa and dsa. rsa1 is also supported to generate legacy SSH-1 keys, but they should never be needed any more.

-b bits Specifies the number of bits in the key. For DSA keys, 1024 is a decent size. For RSA keys, 2048 or even 4096 bits are recommended.

-q Suppresses messages about progress during key generation.

-C new-comment Specifies comment to describe the key. The comment does not impact the operation of the key. The comment can be specified for new keys or for existing keys to change their comment. Typically the comment would be used to identify the key owner, but since any value can be specified, it cannot really be relied upon.

-P Requests to change the key's passphrase. The tool will prompt for a new passphrase. It is not possible to specify a passphrase on the command line. The passphrase will be used to encrypt the private key. See more details on passphrases and how to generate good ones.

--old-passphrase-file file Specifies a file from which to read the old passphrase of the key. This is only needed if manipulating an existing key that is protected by a passphrase.

--new-passphrase file Specifies new passphrase for the key. This can be used when creating a new key, or with the -P option to change the passphrase.

-O output-type Specifies what to output. By default, the private key is output. The following values can be specified:

• private Save the private key in the proprietary PuTTY key format as a .ppk file.
• fingerprint Outputs the fingerprint of the key. The fingerprint uniquely identifies the key and can, for example, be read over the phone to ensure the key is the intended one.
• public Save the public key corresponding to the private key. For SSH2 keys, the public key will be output in the format specified by RFC 4716. This format is supported by, e.g., Tectia SSH. Keys in that format look like this:
  ---- BEGIN SSH2 PUBLIC KEY ---- Comment: user@example.comAAAAB3NzaC1yc2EAAAABIwAAAIEA1on8gxCGJJWSRT4uOrR13mUaUk0hRf4RzxSZ1zRb YYFw8pfGesIFoEuVth4HKyF8k1y4mRUnYHP1XNMNMJl1JcEArC2asV8sHf6zSPVffozZ 5TT4SfsUu/iKy9lUcCfXzwre4WWZSXXcPff+EHtWshahu3WzBdnGxm5Xoi89zcE= ---- END SSH2 PUBLIC KEY ----
• public-openssh Save the public key ony, in OpenSSH's proprietary format. The format is also supported by Tectia SSH. like this:
  ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBN+Mh3U/3We4VYtV1QmWUFIzFLTUeegl1Ao5/QGtCRGAZn8bxX9KlCrrWISIjSYAwCajIEGSPEZwPNMBoK8XD8Q= cow@example.com
• private-openssh Converts the private key to OpenSSH's format. This can only be used for SSH2 keys.
• private-sshcom Converts the private key to the format used by Tectia SSH.
• private-openssh Coverts the private key to the format used by OpenSSH. This format is also supported by Tectia SSH.

-l Same as -O fingerprint.

-L Same as -O public-openssh.

-p Same as -O public.

-o output-file Specifies the output file. This option is mandatory when generating a new key. Otherwise, when changing the passphrase or comment, the default is to overwrite the original file. When outputting a public key or fingerprint, the default is standard output.

-h or --help Outputs help text and usage summary.

-V or --version Outputs version number of the tool.

--pgpfp Outputs the fingerprints of the PGP Master keys used for signing new versions of PuTTY.

Sumber : https://www.ssh.com/ssh/putty/linux/puttygen