Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A SSH private key as generated by ssh-keygen contains a public key part. How do I retrieve this public key from the private key? I've lost my public key and need to put the contents of this public key in the servers authorized_keys file and do not want to create a new key pair.

Alternatively phrased: how do I create the file from a id_rsa file?

share|improve this question
up vote 230 down vote accepted

I've found the answer on Serverfault: Create a public SSH key from the private key?

The option -y outputs the public key:

ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/

As a side note, the comment of the public key is lost. I've had a site which required the comment (Launchpad?), so you need to edit ~/.ssh/ and append a comment to the first line with a space between the comment and key data. An example public key is shown truncated below.

ssh-rsa AAAA..../VqDjtS5 ubuntu@ubuntu
share|improve this answer
you made it piece of cake. thanks – bragboy Jun 4 '15 at 15:39
Please note that your private key file ~/.ssh/id_rsa must be restricted to your username. use $ sudo chmod 600 ~/.ssh/id_rsa and enter your root credentials to restrict it, then you can output the public key file. Otherwise you will get unrestricted private key file warning. – Mark Mikofski Sep 6 '15 at 4:30
@MarkMikofski No need for sudo, you are supposed to own the private key already. Otherwise you cannot read it in the first place. – Lekensteyn Sep 6 '15 at 10:28
@Lekensteyn thanks, of course you're right!. Also 400 is recommended since no need to write to type private key file. Corrected command should be $ chmod 400 ~/.ssh/id_rsa – Mark Mikofski Sep 6 '15 at 14:38

Solution is specifically for users using Windows to SSH into their remote machines including cloud images on AWS and GCE.

(If this works for you, an upvote is highly appreciated. Thanks for your patience.)


Recently used this solution to remote login new deployed vm images on GCE.

Tools used:

  1. puttygen
  2. winscp

Steps to perform:

  1. Generate public/private key pair using puttygen.
  2. Upload public key to your server in cloud or remote location.

Description (how to do it):

  1. Generate a key/pair or use existing private key:

    If you have a private key:

    open puttygen, press load button and select your private key (*.pem) file.

    If you do not have a private key:

    • Open puttygen,
    • Select the desired key type SSH2 DSA (you may use RSA or DSA) within the Parameters section... and it is important that you leave the passphrase field blank,
    • Press generate and follow instructions to generate (public/private) key pair.

      Sample Key Generation pic

  2. Create a new 'authorized_keys' file (with notepad):

    Copy your public key data from the "Public key for pasting into OpenSSH authorized_keys file" section of the PuTTY Key Generator, and paste the key data to the "authorized_keys" file.

    Make sure there is only one line of text in this file.

  3. Upload key to linux server:

    • Open WinSCP,
    • Select SFTP file protocol and login with your ssh credentials.
    • On success, you see home directory structure at your remote machine.

    Upload authorized_keys file to home directory at remote machine.

  4. Set proper permissions:

    Make .ssh directory (if not existed)

    Copy authorized_keys file to .ssh directory. (this will replace any existed authorized_keys file, take note of this).

    If file existed, simply add contents of this file to the existing file.

    Run commands to set permissions:

    sudo chmod 700 .ssh && chmod 600 .ssh/authorized_keys

Now You will be able to ssh into remote machine without entering credentials everytime.

Further reading:



share|improve this answer
If Your home directory is encryted, do this:… – devprashant Nov 21 '15 at 10:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.