<story><title>How to SSH Properly</title><url>https://gravitational.com/blog/how-to-ssh-properly/</url></story><parent_chain><item><author>Ayesh</author><text> - Use Ed25519 keys. They are now supported in pretty much every server out there (all recent OpenSSH versions, GitHub, GitLab, etc). RSA 2048 keys are unbreakable for the foreseeable future, and using 4096 bit keys are just being paranoid with no gain. You can fit 4x Ed25519 keys in a tweet.&lt;p&gt;- Setup and use ssh-agent. They make the life so easy.&lt;p&gt;- You can use Yubikey and pretty much every other solution out there with with OpenSSH now.</text></item></parent_chain><comment><author>jlgaddis</author><text>&amp;gt; &lt;i&gt;Use Ed25519 keys.&lt;/i&gt;&lt;p&gt;&amp;gt; &lt;i&gt;...&lt;/i&gt;&lt;p&gt;&amp;gt; &lt;i&gt;You can use Yubikey and pretty much every other solution out there with with OpenSSH now.&lt;/i&gt;&lt;p&gt;Unfortunately, you can&amp;#x27;t use Ed25519 keys unless you have the latest&amp;#x2F;newest model(s) of Yubikey and that Yubikey came with at least a specific firmware version (5.2.3, IIRC). Even if that weren&amp;#x27;t so, there&amp;#x27;s still loads of popular &amp;#x2F; widely-used software that isn&amp;#x27;t even close to supporting Ed25519 (yet) but &lt;i&gt;has&lt;/i&gt; supported RSA for years and years (and will continue to for the foreseeable future).&lt;p&gt;I&amp;#x27;d like to be able to &amp;quot;upgrade&amp;quot; to an Ed25519 key but I can&amp;#x27;t come up with any real reason to expand my collection of Yubikeys any further (I think I&amp;#x27;m up to nine, at last count, and the three newest ones haven&amp;#x27;t even been opened!). I don&amp;#x27;t plan on purchasing another Yubikey until four or five of the ones I already have decide to call it quits, so I won&amp;#x27;t be using an Ed25519 key anytime in the next couple of years, at least.&lt;p&gt;Even if I could start using an Ed25519 key with my Yubikeys today, I&amp;#x27;d likely still have to keep an RSA key around for the &amp;quot;legacy&amp;quot; stuff, in which case I might as well just save myself the trouble and stick with RSA for a while longer.&lt;p&gt;A private RSA (2048+) key on a Yubikey is still much &amp;quot;better&amp;quot;, IMO, than a private Ed25519 key sitting on one&amp;#x27;s hard drive.&lt;p&gt;In an ideal world we could all just switch everything over to Ed25519 at about the same time and then retire RSA shortly afterwards. It&amp;#x27;s gonna be a long time before everyone has ditched RSA keys and moved to Ed25519, though -- RSA isn&amp;#x27;t going anywhere anytime soon!</text></comment>
<story><title>How to SSH Properly</title><url>https://gravitational.com/blog/how-to-ssh-properly/</url></story><parent_chain><item><author>Ayesh</author><text> - Use Ed25519 keys. They are now supported in pretty much every server out there (all recent OpenSSH versions, GitHub, GitLab, etc). RSA 2048 keys are unbreakable for the foreseeable future, and using 4096 bit keys are just being paranoid with no gain. You can fit 4x Ed25519 keys in a tweet.&lt;p&gt;- Setup and use ssh-agent. They make the life so easy.&lt;p&gt;- You can use Yubikey and pretty much every other solution out there with with OpenSSH now.</text></item></parent_chain><comment><author>ddevault</author><text>&amp;gt;Setup and use ssh-agent. They make the life so easy.&lt;p&gt;My #1 ssh usability tip: put this into ~&amp;#x2F;.ssh&amp;#x2F;config:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    AddKeysToAgent yes
&lt;/code&gt;&lt;/pre&gt;
It&amp;#x27;ll automatically add keys to your agent the first time you use them during a session, so you don&amp;#x27;t need a separate step for adding keys every time you log in.</text></comment>