2

I know that a ssh id_something.pub key by default contains a comment user@host for where it was created. But is it also contained in the key itself?

On one host it seems that ssh -vv somehow got the original comment even when I removed it from the line in authorized_keys on the server and the .pub file on the client and I am not sure where it may come from.

1 Answer 1

4

Both contain the comment

Both the public key and the private key contain the comment, that was set when the key is created. As the comment is merely that - a comment - and has no bearing on authentication of any kind, there is no need to synchronize these either.

In general, a comment is there to identify which computer generated the key, so that the key can be removed if the computer (or at least, the key it generated) is no longer available.

For example, the following command can be used to generate a key:

ssh-keygen -f test -t ed25519 -C "laptop"

This will generate an ed25519 private and public key. The public key will look as follows:

ssh-ed25519 AAAAC....ubB laptop

The comment "laptop" is also written to the private key and can be read as follows:

ssh-keygen -l -f test

This will print:

256 SHA256:EE3....OeqI laptop (ED25519)
3
  • The comment on the public key is easy to remove (if it is not contained in the encoded part as well). Is there a way to remove it from the private key?
    – allo
    Sep 28 at 19:43
  • @allo Yes, you can do that with ssh-keygen -c -C "my new comment" -f yourPrivateKey. -c means changing an existing key, -f specifies the key file and -C defines the new comment. Although it should be noted you should only use comments to identify keys and not put any sensitive info there.
    – Bruh
    Sep 28 at 21:57
  • Nit: the privatekey file contains the comment only using 'new' format, which is the default for all types in 7.8 up, and in 6.5 to 7.7 only for ed25519. If you create(d) a non-ed key below 7.8, or in 7.8 up use -m pem (for non-ed), it does not. Sep 29 at 9:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.