Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to generate the key pair (without a passphrase) on a remote machine. The command I use for this is:

ssh root@REMOTEIP ssh-keygen -t rsa -f /root/.ssh/id_rsa_new -q -N ""

The output of this command is:

ssh-keygen: option requires an argument -- N
Usage: ssh-keygen [options]
  -a trials   Number of trials for screening DH-GEX moduli.
  -B          Show bubblebabble digest of key file.
  -b bits     Number of bits in the key to create.
  -C comment  Provide new comment.
  -c          Change comment in private and public key files.
  -e          Convert OpenSSH to IETF SECSH key file.
  -F hostname Find hostname in known hosts file.
  -f filename Filename of the key file.
  -G file     Generate candidates for DH-GEX moduli.
  -g          Use generic DNS resource record format.
  -H          Hash names in known_hosts file.
  -i          Convert IETF SECSH to OpenSSH key file.
  -l          Show fingerprint of key file.
  -M memory   Amount of memory (MB) to use for generating DH-GEX moduli.
  -N phrase   Provide new passphrase.
  -P phrase   Provide old passphrase.
  -p          Change passphrase of private key file.
  -q          Quiet.
  -R hostname Remove host from known_hosts file.
  -r hostname Print DNS resource record.
  -S start    Start point (hex) for generating DH-GEX moduli.
  -T file     Screen candidates for DH-GEX moduli.
  -t type     Specify type of key to create.
  -v          Verbose.
  -W gen      Generator to use for generating DH-GEX moduli.
  -y          Read private key file and print public key.

When I use a passphrase, the command works just fine:

ssh root@REMOTEIP ssh-keygen -t rsa -f /root/.ssh/id_rsa_new -q -N "12345"
share|improve this question

To avoid this, you have to quote the entire command to avoid it being split by your local shell:

ssh root@REMOTEIP "ssh-keygen -t rsa -f /root/.ssh/id_rsa_new -q -N ''"

The problem is that ssh, aiming to be compatible with rsh (which it initially replaced), sends the entire command line as a single argument that is later passed to the remote shell (on Unix, $SHELL -c "your command").

  1. When you run

    ssh root@REMOTEIP ssh-keygen -t rsa -f /root/.ssh/id_rsa_new -q -N ""

  2. the local shell executes

    ["ssh", "root@REMOTEIP", "ssh-keygen", "-t", "rsa", "-f", "/root/.ssh/id_rsa_new", "-q", "-N", ""]

  3. which ssh concatenates together to get

    "ssh-keygen -t rsa -f /root/.ssh/id_rsa_new -q -N "

  4. and the remote shell splits again to

    ["ssh-keygen", "-t", "rsa", "-f", "/root/.ssh/id_rsa_new", "-q", "-N"]

    – notice the missing empty arguments.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.