github-keygen - bootstrap your Github SSH configuration
git clone https://github.com/dolmen/github-keygen.git cd github-keygen ./github-keygen <my-github-username> cd .. rm -Rf github-keygen
Windows (with msysgit or Cygwin):
git clone https://github.com/dolmen/github-keygen.git cd github-keygen github-keygen <my-github-username> cd .. rd /S /Q github-keygen
This script makes it easy to create an initial environment setup for secure Github exchanges. More secure that what the Github help pages recommends.
But it does much more than that:
- This tool automates the SSH setup. Fewer human errors. And a high level of security.
- It creates a new SSH private key dedicated to Github exchanges. This is much better than using the same SSH key to connect to multiple hosts. (If you loose that key, just revoke it in you Github account, remove the key file, and re run
- As the process of creating an different SSH key for Github now becomes easy, it is now much easier to use a different SSH key for Github on each computer you use to publish on Github. This will help you to use the best practices in SSH security. (If you lose that computer or if it is compromised, just revoke the key in your Github account: you don't have to recreate a new key on all your other computers).
- The Github manual tells to remove your existing SSH keys. But this may not be what you want. This tool avoids that: keep your keys and your existing SSH config; they will not be used for Github.
- It setups a very secure SSH configuration for Github, independent of your other SSH settings:
- Enable only the authentication method used with Github (publickey)
- Use only the private key dedicated to Github (the IdentitiesOnly of SSH config)
- Setup a dedicated known_hosts file with the Github SSH hosts and enable strict host checking (this means that if you get SSH alerts about host key problem when connecting to GitHub, this is really a serious error and you should check that someone is not altering your network link).
- Disable bad things that could come from the Github hosts ("Trust no-one")
- It enables SSH connection sharing (see the ControlMaster option in ssh_config(5) and this blog post)
- It creates unique host aliases for github.com/gist.github.com that you'll be able to use in Git URLs (
git remote) to connect to a particular account. This gives the flexibility to use multiple Github accounts (and therefore a different SSH key for each).
<account>.github.com:<repo-owner>/<repo>.git (for each account) github.com:<repo-owner>/<repo>.git (for the default account)
in addition to:
This script will:
- Create a new SSH key dedicated only to your Github connections in ~/.ssh/id_<github-account>@github
- Create the SSH configuration optimized for Github and dedicated to Github (does not impact your other SSH configurations) in ~/.ssh/config.
- Install the Github SSH host authentication fingerprints in ~/.ssh/github_known_hosts
As with any software that deals with the security of your computer or of communications with other computers (operating system, antivirus, HTTPS implementation, password storage...), you have to be able to trust it. (If you haven't ever asked yourself that question about the software you already use, you should!)
Here are some arguments that should help you to make your choice:
github-keygenis written in a scripting language (Perl), so the code that runs is the code in the script. You can audit it (or ask someone who you trust to do it for you) to trust it.
- When running,
github-keygenonly generates files locally on your system. It will not connect to your Github account (or other hosts).
github-keygenonly generates configuration files for OpenSSH. So:
- After running
github-keygen, you can (and should) audit that config to check the changes it did to your system before connecting to any SSH hosts.
- No part of that configuration is directly executable: it is just data that OpenSSH will use.
- No executable parts of
github-keygenwill run after that (the tool itself is not installed in your system) and you can even delete it: the configuration it produced will still work.
- After running
github-keygenis very conservative in what it does to your SSH config (which means it will not corrupt what it didn't generate itself), so don't worry about configuration you may already have in your ~/.ssh/config: it will be kept as is. (still, bugs may be present, so read the license before using the software).
- I (Olivier Mengué) am not an expert in software security. However this list should show you that I care enough about security to have thought about many issues, and thought to design the software to have trust in it at least as much (in fact much more) than in other security software I use every day.
I'm using the SSH configuration generated by this tool every day on multiple computers, so you can trust that any change on Github side that may affect that config will be immediately detected by the author and upgrades will be made available quickly.
github-keygen is not really the kind of software you have to install. This is more like a wizard that you use just once. So just get the file, run it, and delete it.
Fetch the script from GitHub:
git clone https://github.com/dolmen/github-keygen.git cd github-keygen
Unix/Linux only: install the optional
xclip tool (using your package manager). It will be used to copy your public key to the X11 clipboard once created.
To upgrade your config to the latest one, update
github-keygen and relaunch it. It will update your ~/.ssh/config and show you the diff of what it changed:
cd github-keygen git rebase ./github-keygen
github-keygen is released with Git on Github, you can simply use the diff feature of Git/Github to view exactly what happened between two releases. And you can also have a look to the commit log.
Create ~/.ssh with rights 0700 if it doesn't exists because ssh-keygen(1) will fail if it is missing.
Add support for host
ssh.github.comfor SSH over https port. Add
*.ssh.github.comhost aliases for Git. Users should run again 'github-keygen' (without argument) to enable those new features.
Fixed [issue #13](https://github.com/dolmen/github-keygen/issues/13): default Github account set with `--default` option was lost when running again github-keygen without repeating the setting. The issue existed since v1.004.
Darwin: implemented pasting the public key to the clipboard. Thanks to Vincent Pit for testing!
Added support for dashes in Github usernames. Thanks Pedro Figueiredo!
Added connection sharing: connection to Github is kept alive for 60 seconds. This speeds-up any script that do multiple sequential Git interactions with Github.
Fixed a message that wrongly told to paste the private key (
'.pub'forgotten). Fixed at the Quack and Hack 2012 Europe hackathon, but released (too) long later.
UI improvement: when keys are created, the message about what to do with the key is now shown at the end, after the diff instead of before.
No functional changes.
Updated Pod::Simple to 3.23. Updated copyright.
Changes for compatibility with msysgit's bundled perl (an antique 5.8.8 with major core modules missing:
Pod::*). So no changes for Unix users, but a big improvement for all Windows+msysgit users: no need to install StrawberryPerl just for
No changes in the github-keygen code, but the fatpacked build has been tweaked to use a better list of packed modules. This should improve compatibility.
No functional changes, but distribution changes: branch
masterabandoned and replaced by
release(build result) and
github-keygenis now fatpacked from
develbranch with https://metacpan.org/module/Pod::Usage|Pod::Usage and https://metacpan.org/module/Text::Diff|Text::Diff, so those modules do not have to be installed before usage.
See the git log.
github-keygen requires a Perl runtime. It is regularly tested in the following environments:
- Ubuntu with perl 5.14.2
- Windows with StrawberryPerl (5.12.1 and above) and msysgit
- Windows with msysgit's antique perl 5.8.8.
- on Win32, ~/.ssh/config is always written in CRLF end-of-line style. This is not a bug, it's a feature.
Or fill an issue at Github: https://github.com/dolmen/github-keygen/issues
Olivier Mengué, mailto:email@example.com.
Eric Lefevre: documentation patch.
Pedro Figueiredo: support for Github account with dashes (v1.009).
If you want to contribute, have a look to CONTRIBUTING.pod.
Copyright © 2012 Olivier Mengué.
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.