openssh - Adding an ssh key from putty to authorized_keys

Question

I have been provided with an ssh key by a colleague to add to the authorized_keys file for an account on a linux server so they can access that account.

The file looks something like this:

---- BEGIN SSH2 PUBLIC KEY ----
Comment: "rsa-key-20160816"
AAAAB3NzaC1yc2EAAAABJQAAAQEApoYJFnGDNis/2oCT6/h9Lzz2y0BVHLv8joXM
s4SYcYUVwBxNzqJsDWbikBn/h32AC36qAW24Bft+suGMtJGS3oSX53qR7ozsXs/D
lCO5FzRxi4JodStiYaz/pPK24WFOb4sLXr758tz2u+ZP2lfDfzn9nLxregZvO9m+
zpToLCWlXrzjZxDesJOcfh/eszU9KUKXfXn6Jsey7ej8TYqB2DgYCfv8jGm+oLVe
UOLEl7fxzjgcDdiLaXbqq7dFoOsHUABBV6kaXyE9LmkbXZB9lQ==
---- END SSH2 PUBLIC KEY ----

The man page for authorized_keys (well, sshd) makes it clear that the file expects each key to take up a single line. So I guess I need to convert this key to a single-line format? How do I accomplish this?

Answer 1

There is an accepted answer for this question, but I think it's worth noting that there is a way to do this using the ssh-keygen tool rather than sed:

ssh-keygen -i -f ssh2.pub > openssh.pub

Where ssh2.pub is your existing ssh2 key and openssh.pub will be the key in openssh format. If you just want to copy and paste you can leave out the redirect and use:

ssh-keygen -i -f ssh2.pub

Answer 2

• Remove the BEGIN and END lines
• Optionally remove the Comment line (you can keep note of this if you want to add it as a comment later)
• Remove all remaining line-breaks
• Add the text "ssh-rsa" to the start of the line

The key now becomes:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEApoYJFnGDNis/2oCT6/h9Lzz2y0BVHLv8joXMs4SYcYUVwBxNzqJsDWbikBn/h32AC36qAW24Bft+suGMtJGS3oSX53qR7ozsXs/DlCO5FzRxi4JodStiYaz/pPK24WFOb4sLXr758tz2u+ZP2lfDfzn9nLxregZvO9m+zpToLCWlXrzjZxDesJOcfh/eszU9KUKXfXn6Jsey7ej8TYqB2DgYCfv8jGm+oLVeUOLEl7fxzjgcDdiLaXbqq7dFoOsHUABBV6kaXyE9LmkbXZB9lQ== rsa-key-20160816

This one-liner will do all of the above, apart from append the comment (this assumes GNU sed):

sed key.pub -e 's/---- B.*/ssh-rsa /;/Comment:/d;'|sed ':a;N;$!ba;s/\n//g;s/---.*//'

Answer 3

tl;dr

For the example key you provided (output by PuTTY):

---- BEGIN SSH2 PUBLIC KEY ----
Comment: "rsa-key-20160816"
AAAAB3NzaC1yc2EAAAABJQAAAQEApoYJFnGDNis/2oCT6/h9Lzz2y0BVHLv8joXM
s4SYcYUVwBxNzqJsDWbikBn/h32AC36qAW24Bft+suGMtJGS3oSX53qR7ozsXs/D
lCO5FzRxi4JodStiYaz/pPK24WFOb4sLXr758tz2u+ZP2lfDfzn9nLxregZvO9m+
zpToLCWlXrzjZxDesJOcfh/eszU9KUKXfXn6Jsey7ej8TYqB2DgYCfv8jGm+oLVe
UOLEl7fxzjgcDdiLaXbqq7dFoOsHUABBV6kaXyE9LmkbXZB9lQ==
---- END SSH2 PUBLIC KEY ----

The one-line format (eg as expected by authorized_keys) is:

ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEApoYJFnGDNis/2oCT6/h9Lzz2y0BVHLv8joXM
s4SYcYUVwBxNzqJsDWbikBn/h32AC36qAW24Bft+suGMtJGS3oSX53qR7ozsXs/D
lCO5FzRxi4JodStiYaz/pPK24WFOb4sLXr758tz2u+ZP2lfDfzn9nLxregZvO9m+
zpToLCWlXrzjZxDesJOcfh/eszU9KUKXfXn6Jsey7ej8TYqB2DgYCfv8jGm+oLVe
UOLEl7fxzjgcDdiLaXbqq7dFoOsHUABBV6kaXyE9LmkbXZB9lQ==

There's no magical command to convert here. If you look close, I just removed a few lines, removed the newlines, and prepended it with ssh-rsa

Explanation

The default format that putty uses is defined in RFC4716.

From man ssh-keygen, ssh-keygen supports 3x formats:

1. RFC4716
2. PKCS8
3. PEM

 -m key_format
        Specify a key format for the -i (import) or -e (export) conver‐
        sion options.  The supported key formats are: “RFC4716” (RFC
        4716/SSH2 public or private key), “PKCS8” (PEM PKCS8 public key)
        or “PEM” (PEM public key).  The default conversion format is
        “RFC4716”.  Setting a format of “PEM” when generating or updating
        a supported private key type will cause the key to be stored in
        the legacy PEM private key format.

The default used by ssh-keygen and PuTTY is actually the same (RFC4716), except that the id_rsa.pub file puts it on one line, which is what the authorized_keys file expects.

Example Key

For example, I'll generate a new key in Debian 10:

user@disp8452:~$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:lrwmOoBF1PEtDbbVkFwREgWqdJlH5ViEYzQpUAyPyNY user@disp8452
The key's randomart image is:
+---[RSA 2048]----+
| ...+*+oX&Oo     |
| ..o.=o@B*.      |
| .+ E Xo=..      |
| ... o + .       |
| o  .   S        |
|. .    . .       |
|   .  . o        |
|    .. o         |
|    ..           |
+----[SHA256]-----+
user@disp8452:~$ cat /home/user/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzU4exWqu4tsgWIJleq1AJ98cGHswD80cphWYOasspBoOPgdv1rljgb9PFAQX19X+rofYi+aYd1glP8BhRC3rt4zE26J54h8tt46DBT1TkFPJ2O3ULhLSqcv9zENGkGB0bfXkvhI0p/tP4b1a0NnvmNME9i6qyo8/7mPLovaKwP1qkd7/a+p1DQr2XoId9U6G4rx0TKsvhbjmDvaCWAm4c5LT3WbQHh301DWiwsN8xn8LkxaO4GtdIqxHOyj7lmQZGw8ixuvoIY/FjgXhSPGmaWLyz2o45TrTNP7vWxWqgcDi2CegziD67+UN4tBZvB9HwR6V3aaCrV59H15ukAtK1 user@disp8452
user@disp8452:~$ 

RFC4716

You can get that in the PuTTY RFC4716 format as follows:

user@disp8452:~$ ssh-keygen -ef /home/user/.ssh/id_rsa -mRFC4716
---- BEGIN SSH2 PUBLIC KEY ----
Comment: "2048-bit RSA, converted by user@disp8452 from OpenSSH"
AAAAB3NzaC1yc2EAAAADAQABAAABAQCzU4exWqu4tsgWIJleq1AJ98cGHswD80cphWYOas
spBoOPgdv1rljgb9PFAQX19X+rofYi+aYd1glP8BhRC3rt4zE26J54h8tt46DBT1TkFPJ2
O3ULhLSqcv9zENGkGB0bfXkvhI0p/tP4b1a0NnvmNME9i6qyo8/7mPLovaKwP1qkd7/a+p
1DQr2XoId9U6G4rx0TKsvhbjmDvaCWAm4c5LT3WbQHh301DWiwsN8xn8LkxaO4GtdIqxHO
yj7lmQZGw8ixuvoIY/FjgXhSPGmaWLyz2o45TrTNP7vWxWqgcDi2CegziD67+UN4tBZvB9
HwR6V3aaCrV59H15ukAtK1
---- END SSH2 PUBLIC KEY ----
user@disp8452:~$ 

Note that the fingerprint line is actually the same, so you can manually convert between the multi-line format output by PuTTY and the one-line format just by removing the BEGIN, Comment, and END lines. Then remove newlines and prepend it with ssh-rsa .

PKCS8

And to be complete, here's the PKCS8 format of the key above:

user@disp8452:~$ ssh-keygen -ef /home/user/.ssh/id_rsa -mPKCS8
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs1OHsVqruLbIFiCZXqtQ
CffHBh7MA/NHKYVmDmrLKQaDj4Hb9a5Y4G/TxQEF9fV/q6H2IvmmHdYJT/AYUQt6
7eMxNuieeIfLbeOgwU9U5BTydjt1C4S0qnL/cxDRpBgdG315L4SNKf7T+G9WtDZ7
5jTBPYuqsqPP+5jy6L2isD9apHe/2vqdQ0K9l6CHfVOhuK8dEyrL4W45g72glgJu
HOS091m0B4d9NQ1osLDfMZ/C5MWjuBrXSKsRzso+5ZkGRsPIsbr6CGPxY4F4Ujxp
mli8s9qOOU60zT+71sVqoHA4tgnoM4g+u/lDeLQWbwfR8Eeld2mgq1efR9ebpALS
tQIDAQAB
-----END PUBLIC KEY-----
user@disp8452:~$

PEM

And the PEM format:

user@disp8452:~$ ssh-keygen -ef /home/user/.ssh/id_rsa -mPEM
-----BEGIN RSA PUBLIC KEY-----
MIIBCgKCAQEAs1OHsVqruLbIFiCZXqtQCffHBh7MA/NHKYVmDmrLKQaDj4Hb9a5Y
4G/TxQEF9fV/q6H2IvmmHdYJT/AYUQt67eMxNuieeIfLbeOgwU9U5BTydjt1C4S0
qnL/cxDRpBgdG315L4SNKf7T+G9WtDZ75jTBPYuqsqPP+5jy6L2isD9apHe/2vqd
Q0K9l6CHfVOhuK8dEyrL4W45g72glgJuHOS091m0B4d9NQ1osLDfMZ/C5MWjuBrX
SKsRzso+5ZkGRsPIsbr6CGPxY4F4Ujxpmli8s9qOOU60zT+71sVqoHA4tgnoM4g+
u/lDeLQWbwfR8Eeld2mgq1efR9ebpALStQIDAQAB
-----END RSA PUBLIC KEY-----
user@disp8452:~$