Search code examples
gitgithubsshssh-keygen

Understanding ssh-keygen for SSH'ing into a server vs accessing GitHub


So my understanding is that ssh-keygen is one of many commands provided by OpenSSH.

When generating a private/public key pair using ssh-keygen, I know that you can put the public key onto a remote server (inside ~/.ssh/authorised_keys) and it'll allow you to ssh into that server.

But it seems like there are two different ways of generating the key pair though, in the sense that you can just use ssh-keygen alone, and when you cat the public key you'll see something like:

ssh-rsa XXXX User@ComputerName

Where User@ComputerName looks something like M@Marks-MBP.default for me.

The other way is using the -C comment flag (GitHub suggests doing this). Where it seems that it'll not use User@ComputerName but your email address instead in its place (or whatever 'comment' you happen to use).

Am I right in thinking that for SSH'ing into a server, the username you use to login is whatever the -C comment is set to in your public key?

So if I don't use -C at all, then it'll generate a public key with M@Marks-MBP.default at the end. I then assume the username would be M.

But if I use -C "bingbop", then I assume the username to SSH would be bingbop.

Is that correct?

Also, is there any technical reason GitHub suggest using -C to specify your email address rather than leaving that flag off?

I'm guessing that when you try to clone or push to your repo (using their git@github.com:<user>/<repo>.git protocol) that it can't identify you by the public key alone, it needs the comment to be set to your GitHub email address


Solution

  • Am I right in thinking that for SSH'ing into a server, the username you use to login is whatever the -C comment is set to in your public key?

    No. The key's comment field is really just that: An (optional) comment, which by convention usually is set to your email address, but happens to default to user@host if not specified.

    The username you use when logging in via SSH is not related to or derived from that comment field.

    Also, is there any technical reason GitHub suggest using -C to specify your email address rather than leaving that flag off?

    Yes, the reason being that the default of user@host rarely provides useful information to someone you give your public key to. Your email address on the other hand is more valuable information.

    I'm guessing that when you try to clone or push to your repo (using their git@github.com:/.git protocol) that it can't identify you by the public key alone, it needs the comment to be set to your GitHub email address.

    GitHub can identify you by the provided key alone as it is unique across all GitHub users. In the URI syntax you've given, the git before the @ is the username provided to SSH. So GitHub uses a generic username of git for all its users, and individual users are identified by the key they provide.