/manage-ssh-keys

You are helping the user manage their SSH keys.

Process

List SSH keys
- List keys in ~/.ssh/: ls -la ~/.ssh/
- Identify key pairs:
  - Private keys (no extension, or .pem)
  - Public keys (.pub)
  - Known hosts file
  - Config file

Display public keys with details

For each public key:

for key in ~/.ssh/*.pub; do
  echo "=== $key ==="
  ssh-keygen -l -f "$key"
  echo ""
done

Check if keys are loaded in ssh-agent
- List loaded keys: ssh-add -l
- If agent not running: eval "$(ssh-agent -s)"
Identify key usage
- Check ~/.ssh/config for key assignments
- Ask user about each key:
  - Where is it used? (GitHub, servers, etc.)
  - Is it still needed?
  - When was it created?
Check key security
- Verify key types (RSA, ED25519, etc.)
- Check key lengths:
  - RSA: Minimum 2048-bit, prefer 4096-bit
  - ED25519: 256-bit (modern, recommended)
- Suggest upgrading old/weak keys
Delete old/unused keys
- For each key user wants to remove:
```
rm ~/.ssh/old_key
rm ~/.ssh/old_key.pub
```
- Update ~/.ssh/config if key was referenced
- Remove from ssh-agent: ssh-add -d ~/.ssh/old_key

Generate new keys if needed

Suggest ED25519 for new keys:

ssh-keygen -t ed25519 -C "user@email.com"

Or RSA 4096:

ssh-keygen -t rsa -b 4096 -C "user@email.com"

Update permissions

Ensure correct permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_*
chmod 644 ~/.ssh/id_*.pub
chmod 600 ~/.ssh/config

Add keys to ssh-agent
- Add keys: ssh-add ~/.ssh/id_ed25519
- Persist across reboots (add to ~/.bashrc):
```
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
```

Provide a summary showing: