15

Long ago I generated a key pair using ssh-keygen and I used ssh-copy-id to enable login onto many development VMs without manually having to enter a password. I've also uploaded my public key on GitHub, GitLab and similar to authenticate to git repositories using git@ instead of https://.

How can I reinstall my Linux desktop and keep all these logins working? Is backing up and restoring ~/.ssh/ enough?

  • 2
    That is one of many reasons why when you install a new Linux environment you should have a partition for / and another one for /home – olegario Jun 24 at 11:15
  • 4
    @olegario I disagree. I've used Linux for the better part of my life, and currently administrate >100 machines, but I've always found a separate /home partition both a hassle and of limited use. I understand some people find it useful, and that's fine, but I don't think it's adequate help for the OPs situation anyway. – marcelm Jun 24 at 16:25
  • 5
    There's really no advantage to a partition over just backing up and restoring /home via tar or any other means, unless you plan to reuse the existing partitions, which is risky anyway with most OS installers that will happily wipe them, unless it's on a separate physical disk you remove during install. – R.. Jun 24 at 17:16
  • 1
    Once you're done with the reinstall, no matter how exactly you do it, you might want to reconsider having just one key pair for everything. – a CVn Jun 24 at 21:32
29

You need to back up your private keys, at the very least. They cannot be regenerated without having to replace your public key everywhere. These would normally have a name starting with id_ and no extension.

The public keys can be regenerated with this command: ssh-keygen -y -f path/to/private/key. Your user configuration (a file called "config") could also be useful if you have set any non-defaults.

All of these files would normally be in ~/.ssh, but check first!

28

For outgoing SSH connections, backing up your key pair is enough. For convenience, you might just backup your ~/.ssh directory and restore it onto the new installation.

Normally backing up and restoring that directory is enough, but it is possible to store the keys elsewhere by either using custom settings in ~/.ssh/config or /etc/ssh/ssh_config, or by using a SSH-agent and ssh-add to pick up the keys to be used on outgoing connections from an arbitrary location.

If you have incoming SSH connections, you might also consider backing up the SSH host keys at /etc/ssh/ssh_host_*. If you don't backup these, new host keys will be automatically generated by sshd as it starts for the first time on the new installation, and any incoming SSH connections will show the "SSH host key mismatch, someone may be doing something bad!" error message and usually reject the connection unless someone deletes the old host key on the SSH client and explicitly accepts the new one.

It sounds like you might not have incoming SSH connections on your Linux desktop system, so I'm mentioning this only for the sake of completeness. But on server systems, or if you have significant SSH-based automation set up, acknowledging a changed host key might be a major hassle.

  • 1
    +1 This should be the accepted answer. To login from other machines, you have to keep the host key, usually stored in /etc/ssh, file names are ssh_host_* (several files for different algorithms). – rexkogitans Jun 25 at 6:23
  • 2
    Note that if you're SSHing in, you might want to rotate the host keys anyway; but this depends on your key management situation (e.g. the keys were last generated years ago, and you don't have /etc/ssh/ssh_host_ed25519_key yet, or you have a RSA 1024 key, or even a DSS key). – Piskvor Jun 25 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.