Skip to content

Toolroom

ssh_keygen

willemkokke/toolroom

ssh_keygen¶

ssh-keygen documentation

toolroom._stubs.ssh_keygen.SshKeygen ¶

Bases: Tool[_R]

call ¶

__call__(
    *args: str | PathLike[str],
    A: Flag = ...,
    B: Flag = ...,
    C: Value = ...,
    D: Value = ...,
    E: Value = ...,
    F: Flag = ...,
    G: Value = ...,
    H: Flag = ...,
    I: Value = ...,
    J: Value = ...,
    K: Flag = ...,
    L: Flag = ...,
    M: Value = ...,
    N: Value = ...,
    O: Value = ...,
    P: Value = ...,
    Q: Flag = ...,
    R: Flag = ...,
    S: Value = ...,
    T: Value = ...,
    U: Flag = ...,
    V: Value = ...,
    W: Value = ...,
    Y: Value = ...,
    Z: Value = ...,
    a: Value = ...,
    b: Value = ...,
    c: Flag = ...,
    e: Flag = ...,
    f: Value = ...,
    g: Flag = ...,
    h: Flag = ...,
    i: Flag = ...,
    j: Value = ...,
    k: Flag = ...,
    l: Flag = ...,
    m: Value = ...,
    n: Value = ...,
    o: Flag = ...,
    p: Flag = ...,
    q: Flag = ...,
    r: Value = ...,
    s: Value = ...,
    t: Flag = ...,
    u: Flag = ...,
    v: Flag = ...,
    w: Value = ...,
    y: Flag = ...,
    z: Value = ...,
    **flags: Any,
) -> _R

OpenSSH authentication key utility

Parameters:

Name	Type	Description	Default
`A`	`Flag`	Generate host keys of all default key types (rsa, ecdsa, mldsa44-ed25519 and ed25519) if they do not already exist. Added in 5.9p1.	`...`
`B`	`Flag`	Show the bubblebabble digest of specified private or public key file.	`...`
`C`	`Value`	Provides a new comment.	`...`
`D`	`Value`	Download the public keys provided by the PKCS#11 shared library pkcs11. Added in 3.0p1.	`...`
`E`	`Value`	Specifies the hash algorithm used when displaying key fingerprints. Added in 6.8p1.	`...`
`F`	`Flag`	Search for the specified hostname (with optional port number) in a known_hosts file, listing any occurrences found. Added in 4.0p1.	`...`
`G`	`Value`	Generate candidate primes for DH-GEX. Gone since 8.2p1.	`...`
`H`	`Flag`	Hash a known_hosts file. Added in 4.0p1.	`...`
`I`	`Value`	Specify the key identity when signing a public key. Added in 5.4p1.	`...`
`J`	`Value`	Exit after screening the specified number of lines while performing DH candidate screening using the -T option. Gone since 8.2p1.	`...`
`K`	`Flag`	Download resident keys from a FIDO authenticator. Added in 6.0p1.	`...`
`L`	`Flag`	Prints the contents of one or more certificates. Added in 5.4p1.	`...`
`M`	`Value`	Generate candidate Diffie-Hellman Group Exchange (DH-GEX) parameters for eventual use by the 'diffie-hellman-group-exchange-*' key exchange methods. Added in 3.7p1.	`...`
`N`	`Value`	Provides the new passphrase.	`...`
`O`	`Value`	Specify a key/value option. May be repeated: a list emits the flag once per item. Added in 5.4p1.	`...`
`P`	`Value`	Provides the (old) passphrase.	`...`
`Q`	`Flag`	Test whether keys have been revoked in a KRL. Added in 6.2p1.	`...`
`R`	`Flag`	Removes all keys belonging to the specified hostname (with optional port number) from a known_hosts file. Added in 4.0p1.	`...`
`S`	`Value`	Specify start point (in hex) when generating candidate moduli for DH-GEX. Gone since 8.2p1.	`...`
`T`	`Value`	Test DH group exchange candidate primes (generated using the -G option) for safety. Gone since 8.2p1.	`...`
`U`	`Flag`	When used in combination with -s or -Y sign, this option indicates that a CA key resides in an ssh-agent(1). Added in 3.0p1.	`...`
`V`	`Value`	Specify a validity interval when signing a certificate. May be repeated: a list emits the flag once per item. Added in 5.4p1.	`...`
`W`	`Value`	Specify desired generator when testing candidate moduli for DH- GEX. Gone since 8.2p1.	`...`
`Y`	`Value`	Find the principal(s) associated with the public key of a signature, provided using the -s flag in an authorized signers file provided using the -f flag. Added in 8.1p1.	`...`
`Z`	`Value`	Specifies the cipher to use for encryption when writing an OpenSSH-format private key file. Added in 8.5p1.	`...`
`a`	`Value`	When saving a private key, this option specifies the number of KDF (key derivation function, currently bcrypt_pbkdf(3)) rounds used. Added in 3.7p1.	`...`
`b`	`Value`	Specifies the number of bits in the key to create.	`...`
`c`	`Flag`	Requests changing the comment in the private and public key files.	`...`
`e`	`Flag`	This option will read a private or public OpenSSH key file and print to stdout a public key in one of the formats specified by the -m option.	`...`
`f`	`Value`	Specifies the filename of the key file.	`...`
`g`	`Flag`	Use generic DNS format when printing fingerprint resource records using the -r command. Added in 3.7p1.	`...`
`h`	`Flag`	When signing a key, create a host certificate instead of a user certificate. Added in 5.4p1.	`...`
`i`	`Flag`	This option will read an unencrypted private (or public) key file in the format specified by the -m option and print an OpenSSH compatible private (or public) key to stdout.	`...`
`j`	`Value`	Start screening at the specified line number while performing DH candidate screening using the -T option. Gone since 8.2p1.	`...`
`k`	`Flag`	Generate a KRL file. Added in 6.2p1.	`...`
`l`	`Flag`	Show fingerprint of specified public key file.	`...`
`m`	`Value`	Specify a key format for key generation, the -i (import), -e (export) conversion options, and the -p change passphrase operation. May be repeated: a list emits the flag once per item. Added in 5.6p1.	`...`
`n`	`Value`	Specify one or more principals (user or host names) to be included in a certificate when signing a key. May be repeated: a list emits the flag once per item. Added in 5.4p1.	`...`
`o`	`Flag`	Causes ssh-keygen to save private keys using the new OpenSSH format rather than the more compatible PEM format. Gone since 7.8p1.	`...`
`p`	`Flag`	Requests changing the passphrase of a private key file instead of creating a new private key.	`...`
`q`	`Flag`	Silence ssh-keygen.	`...`
`r`	`Value`	Print the SSHFP fingerprint resource record named hostname for the specified public key file. Added in 3.7p1.	`...`
`s`	`Value`	Certify (sign) a public key using the specified CA key. Added in 5.4p1.	`...`
`t`	`Flag`	Specifies the type of key to create.	`...`
`u`	`Flag`	Update a KRL. Added in 6.2p1.	`...`
`v`	`Flag`	Verbose mode. Added in 3.8p1.	`...`
`w`	`Value`	Specifies a path to a library that will be used when creating FIDO authenticator-hosted keys, overriding the default of using the internal USB HID support. Added in 8.2p1.	`...`
`y`	`Flag`	This option will read a private OpenSSH format file and print an OpenSSH public key to stdout.	`...`
`z`	`Value`	Specifies a serial number to be embedded in the certificate to distinguish this certificate from others from the same CA. Added in 5.6p1.	`...`