SSH Key Management: Best Practices for Developers

Generating SSH Keys

Use ssh-keygen -t ed25519 -C "your@email.com" for modern key generation. Ed25519 keys are 256-bit, provide strong security, and generate faster than RSA. Always set a passphrase — it encrypts your private key at rest. If you need RSA compatibility (rare in 2026), use -t rsa -b 4096.

SSH Config File

The ~/.ssh/config file is the most underused SSH feature. Define hosts with aliases: Host prod → HostName 192.168.1.100, User deploy, IdentityFile ~/.ssh/prod_key. Now ssh prod connects with all settings. Group common settings with Host * for defaults.

SSH Agent and Key Forwarding

ssh-agent holds decrypted keys in memory so you type your passphrase once per session. ssh-add ~/.ssh/id_ed25519 loads a key. On macOS, add AddKeysToAgent yes and UseKeychain yes to your SSH config for keychain integration. Agent forwarding (-A flag) lets you use local keys on remote servers.

Per-Service Key Strategy

Use separate keys for GitHub, GitLab, production servers, and CI systems. If one key is compromised, only that service is affected. Configure each in ~/.ssh/config with specific IdentityFile paths. For GitHub deploy keys, generate purpose-specific read-only keys.

Key Rotation and Auditing

Rotate SSH keys at least annually. Audit ~/.ssh/authorized_keys on servers to remove old or unknown keys. Use tools like ssh-audit to check server configuration for weak algorithms. Disable password authentication entirely — keys-only is the standard for production servers.

Security Best Practices

Never share private keys. Never commit them to Git. Use .gitignore patterns for id_* files. Set file permissions: chmod 600 ~/.ssh/id_ed25519 and chmod 700 ~/.ssh. Consider hardware keys (YubiKey) for high-security environments — they store the private key on the device and require physical touch for operations.

Conclusion

SSH key management is a fundamental skill for every developer. Use Ed25519, configure your SSH config file, leverage ssh-agent, and maintain separate keys per service. Good SSH hygiene prevents security incidents and makes your daily workflow faster.