gen-ssh-key

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Generate SSH Keys (Team Standard)

生成SSH密钥（团队标准）

Run one script to produce a standards-compliant SSH key; do not hand-roll ssh-keygen commands. The script bakes in the team rules (key type, naming, permissions, overwrite guard), so using it is what guarantees compliance.

运行单个脚本即可生成符合标准的SSH密钥；请勿手动编写ssh-keygen命令。该脚本内置了团队规则（密钥类型、命名、权限、覆盖保护），因此使用它是确保合规的正确方式。

Workflow

工作流程

Derive
```
<name>
```
from the service or purpose the user mentions (e.g. "jumpserver", "gitlab"). Kebab-case; no spaces or slashes.
Pick flags from the request:
- RSA explicitly requested: add
```
--rsa
```
  (always RSA 4096; the script refuses to produce RSA 2048, which the team bans as too weak).
- Passphrase wanted: write the passphrase to a temporary file, pass
```
--passphrase-file <file>
```
  , and delete the file afterwards. Never put a passphrase on the command line.
- Machine-readable result wanted (or another program consumes it): add
```
--json
```
  (pure JSON on stdout; diagnostics stay on stderr).
- The user named a destination: add
```
--out-dir <dir>
```
  (this may be the current directory, e.g.
```
--out-dir .
```
  ), and keys go straight there. Otherwise, when neither
```
--out-dir
```
  nor the skill's
```
.env
```
  (
```
SSH_KEY_OUTPUT_DIR
```
  ) is set, keys go to the default
```
~/.ssh/generated-keys
```
  .
Run the script from the skill directory:
bash
```
./scripts/gen-ssh-key.sh <name> [flags]
```
Report back: give the user the public key content (it is safe to share) and the file paths. Never print, quote, or transmit the private key contents, and never write the passphrase into results or logs — the JSON output intentionally carries only
```
passphrase_protected: true
```
.

If the target files already exist the script refuses; ask the user before retrying with

--force

根据用户提到的服务或用途推导
```
<name>
```
（例如“jumpserver”、“gitlab”）。使用短横线命名法；不得包含空格或斜杠。
根据请求选择参数：
- 明确要求使用RSA：添加
```
--rsa
```
  参数（始终为RSA 4096；脚本会拒绝生成团队认定强度不足的RSA 2048密钥）。
- 需要密码短语：将密码短语写入临时文件，传入
```
--passphrase-file <file>
```
  参数，使用后删除该文件。绝对不要在命令行中直接输入密码短语。
- 需要机器可读结果（或供其他程序调用）：添加
```
--json
```
  参数（stdout输出纯JSON；诊断信息输出到stderr）。
- 用户指定了目标路径：添加
```
--out-dir <dir>
```
  参数（可以是当前目录，例如
```
--out-dir .
```
  ），密钥将直接生成到该目录。否则，如果既未设置
```
--out-dir
```
  也未设置技能的
```
.env
```
  变量（
```
SSH_KEY_OUTPUT_DIR
```
  ），密钥将生成到默认路径
```
~/.ssh/generated-keys
```
  。
从技能目录运行脚本：
bash
```
./scripts/gen-ssh-key.sh <name> [flags]
```
反馈结果：向用户提供公钥内容（可安全共享）和文件路径。严禁打印、引用或传输私钥内容，也不得将密码短语写入结果或日志——JSON输出中仅会包含
```
passphrase_protected: true
```
字段，这是刻意设计的。

如果目标文件已存在，脚本会拒绝执行；如需使用

--force

参数重试，请先征得用户同意。

Examples

示例

bash

./scripts/gen-ssh-key.sh jumpserver                       # Ed25519 -> jumpserver.{ppk,pem,pub}
./scripts/gen-ssh-key.sh gitlab --rsa                     # RSA 4096
./scripts/gen-ssh-key.sh svc-x --passphrase-file ./pp.txt --json
./scripts/gen-ssh-key.sh jumpserver --out-dir ~/.ssh/generated-keys
./scripts/gen-ssh-key.sh jumpserver --comment "you@example.com"
./scripts/gen-ssh-key.sh jumpserver --dry-run             # show the plan only
./scripts/gen-ssh-key.sh --tool ssh-keygen jumpserver     # skip puttygen
./scripts/gen-ssh-key.sh -h                               # full flag reference

bash

./scripts/gen-ssh-key.sh jumpserver                       # Ed25519 -> jumpserver.{ppk,pem,pub}
./scripts/gen-ssh-key.sh gitlab --rsa                     # RSA 4096
./scripts/gen-ssh-key.sh svc-x --passphrase-file ./pp.txt --json
./scripts/gen-ssh-key.sh jumpserver --out-dir ~/.ssh/generated-keys
./scripts/gen-ssh-key.sh jumpserver --comment "you@example.com"
./scripts/gen-ssh-key.sh jumpserver --dry-run             # show the plan only
./scripts/gen-ssh-key.sh --tool ssh-keygen jumpserver     # skip puttygen
./scripts/gen-ssh-key.sh -h                               # full flag reference

Team rules baked into the script

脚本内置的团队规则

Key type: Ed25519 by default;
```
--rsa
```
means RSA 4096; RSA 2048 never.
Tool: puttygen preferred (adds
```
.ppk
```
for PuTTY users); ssh-keygen fallback.
Naming:
```
<name>.ppk / .pem / .pub
```
so keys are identifiable by service.
Comment
```
-C
```
defaults to
```
<name>
```
; override with
```
--comment
```
.
Private key
```
chmod 600
```
; newly created output directories
```
chmod 700
```
.
Overwrite refused by default;
```
--force
```
required.

密钥类型：默认使用Ed25519；
```
--rsa
```
参数表示使用RSA 4096；绝不允许RSA 2048。
工具：优先使用puttygen（为PuTTY用户生成
```
.ppk
```
文件）；备选ssh-keygen。
命名规则：采用
```
<name>.ppk / .pem / .pub
```
格式，便于通过服务识别密钥。
注释
```
-C
```
默认值为
```
<name>
```
；可通过
```
--comment
```
参数覆盖。
私钥权限设为
```
chmod 600
```
；新建的输出目录权限设为
```
chmod 700
```
。
默认拒绝覆盖已有文件；需使用
```
--force
```
参数强制覆盖。

Configuration

配置

Output directory precedence:

--out-dir

SSH_KEY_OUTPUT_DIR

.env

(at the skill root, one level above

scripts/

) > the built-in default

~/.ssh/generated-keys

. When both

--out-dir

and

.env

are absent, keys go to that default rather than the current directory (so they never silently land in the skill directory); pass

--out-dir .

if you do want the current directory. To change the default persistently,

cp .env.example .env

at the skill root and point

SSH_KEY_OUTPUT_DIR

elsewhere.

输出目录优先级：

--out-dir

> 技能根目录（

scripts/

的上一级）下

.env

文件中的

SSH_KEY_OUTPUT_DIR

> 内置默认路径

~/.ssh/generated-keys

。当既未设置

--out-dir

也未配置

.env

时，密钥会生成到默认路径而非当前目录（因此不会悄无声息地出现在技能目录中）；如果你确实需要生成到当前目录，请传入

--out-dir .

。要永久修改默认路径，可在技能根目录执行

cp .env.example .env

，然后将

SSH_KEY_OUTPUT_DIR

指向其他位置。

Artifacts

生成产物

File	Purpose
`<name>.ppk`	PuTTY-native key (puttygen path only)
`<name>.pem`	OpenSSH private key (chmod 600, keep secret)
`<name>.pub`	OpenSSH public key (share this; import / authorized_keys)

文件	用途
`<name>.ppk`	PuTTY原生密钥（仅puttygen路径生成）
`<name>.pem`	OpenSSH私钥（权限chmod 600，需保密）
`<name>.pub`	OpenSSH公钥（可共享；用于导入/authorized_keys）

Exit codes

退出码

success;

bad argument, target exists, or generation failed;

no usable tool (neither puttygen nor ssh-keygen installed).

成功；

参数错误、目标文件已存在或生成失败；

无可用工具（puttygen和ssh-keygen均未安装）。