ssh using certificates -- can you rename id_rsa file?

Question

When using certificate authentication with ssh, the instructions I have found indicate you should create a key-pair as id_rsa.pub && id_rsa. The public key is then sent to the remote system to be added to authorized_keys (or authorized_keys2 frequently in the case of OS/X). Obviously, the originating system needs access to its private key id_rsa.

I recently broke this by renaming the id_rsa file and fixed it by restoring the file to its original name; so presumably, ssh uses the file ~/.ssh/id_rsa. Is this correct? Is it configurable? I had presumed that I would use different private keys for different remote systems, to limit the impact of a compromised private key; is this simply impractical, and it's better to just re-use a single private key?

Thanks.

Answer 1

ssh uses the ~/.ssh/id_rsa key by default, but you can use the -i command line argument to specify a different identity file to use.

Answer 2

It's completely configurable. Start by generating a new key.

ssh-keygen

When you get to this part:

Generating public/private rsa key pair.
Enter file in which to save the key (/Users/[your Username]/.ssh/id_rsa): 

Enter what you would like to name the key. Go through the rest of the prompts, and your key will be generated with your custom name.

Keep in mind that you should add your key to the "~/.ssh/config" file. If you don't have this file, you can create it. Open the file with a text editor and copy the line below (replacing the parts in square brackets with your information):

IdentityFile "/Users/[your Username]/.ssh/[your SSH Key Name]"

Save the config file and you'll be able to SSH using your custom named SSH Key without requiring the computer's password or your SSH Key's passphrase.