NAME

dropbearkey - make a key for dropbear and dbclient

SYNOPSIS

dropbearkey -t ed25519 | rsa -f file [ -s bits ]
dropbearkey -y -f file

DESCRIPTION

dropbearkey makes a private key, from /dev/urandom, writes it to file (which must not exist yet), readable by its owner only, and prints the public key and its fingerprint. The key is a host key for dropbear(8) or a user's key for dbclient(1). Keys are not encrypted, so the file's mode is all that protects one.

-t type

ed25519 (the one to use: small and fast) or rsa, for a peer that knows no ed25519.

-f file

The private key's file.

-s bits

The size of an RSA key, a multiple of 8 (default 3072). Making one takes minutes on a 68030.

-y

Print the public key and fingerprint of the key in file; the public line is what goes into a server's ~/.ssh/authorized_keys.

EXAMPLES

A key to log in with, and its public half for the server:

$ mkdir -m 700 ~/.ssh
$ dropbearkey -t ed25519 -f ~/.ssh/id_dropbear
$ dropbearkey -y -f ~/.ssh/id_dropbear | grep '^ssh-'

An RSA host key, made by hand instead of by the boot script:

# dropbearkey -t rsa -f /etc/dropbear/host_rsa

SEE ALSO

dbclient(1), dropbear(8)