跳到主要内容

SSH Public Key Management

In AtomGit, you can achieve secure code hosting and submission operations through SSH (Secure Shell Protocol) public keys. SSH public keys offer the following advantages:

  • Convenient Access: After using an SSH public key, you no longer need to enter a password for each operation, making access to AtomGit repositories more efficient.
  • Access Control: You can associate an SSH public key with specific repositories, allowing flexible management of project access permissions.
Notes
  1. SSH public keys are used in pairs with private keys. Please keep your private key secure and avoid leaking it.
  2. If you use AtomGit on multiple devices, it is recommended to generate independent SSH key pairs for each device.

SSH Key Types​

AtomGit supports the following two types of SSH keys:

ED25519 SSH Key​

  • Higher Security: According to Practical Cryptography With Go, ED25519 keys are more secure than RSA keys.
  • Widespread Support: Since the introduction of ED25519 in OpenSSH 6.5 in 2014, all major operating systems have supported this key type.

RSA SSH Key​

  • Key Length Recommendation: If using an RSA key, it is recommended that the key length be 4096 bits (at least 2048 bits) to ensure security.
  • Compatibility: By default, the ssh-keygen command generates RSA keys of 1024 bits. It is recommended to upgrade to a stronger key.
  • Security Tip: Before OpenSSH 7.8, the default fingerprint of RSA keys was based on MD5, which posed a security risk. If you are still using an older RSA key, it is recommended to upgrade to a more secure encryption format.

Generating SSH Keys​

Generating ED25519 SSH Keys​

  1. Open Terminal

    • On Linux/macOS, open the built-in terminal
    • On Windows, you can use Cmd, Power Shell, or Git Bash

  2. Enter the command to generate the key

    Run the following command, replacing your_email@example.com with your email:

    ssh-keygen -t ed25519 -C "your_email@example.com"
    • -t ed25519: Specifies the key type as ED25519.
    • -C "your_email@example.com": Adds a comment, typically using your email address, for easy identification of the key.

  3. Choose the key save location

    After running the command, you will see the following prompt:

    Generating public/private ed25519 key pair.
    Enter file in which to save the key (/Users/user/.ssh/id_ed25519):
    • Press Enter to accept the default location (~/.ssh/id_ed25519).
    • If you want to customize the save path, enter a new path, such as ~/.ssh/my_custom_key.

  4. Set a key password (optional but recommended)

    Next, the system will prompt you to set a password:

    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:
    • Enter a secure password to protect your private key (it is recommended to use a strong password).
    • If you don't need a password, simply press Enter to skip.
    提示

    After setting a password, you will need to enter it every time you use the SSH key. This prevents unauthorized people from using your private key.

  5. Confirm successful key generation

    If the operation is successful, you will see output similar to the following:

    Your identification has been saved in /Users/user/.ssh/id_ed25519
    Your public key has been saved in /Users/user/.ssh/id_ed25519.pub
    The key fingerprint is:
    SHA256:x8gFyNRIg5UsIhqYOnsDYhyxXJNhwBU2WcLs11b421g your_email@example.com
    The key's randomart image is:
    +--[ED25519 256]--+
    |o+*@*O==o        |
    |*o*=* *o.o       |
    |+=o. .. o .      |
    |*o . . + = E     |
    |o+  . . S B      |
    |. o      + .     |
    | . .             |
    |                 |
    |                 |
    +----[SHA256]-----+

  6. View the generated key

    You can view the generated public key content using the following command:

    cat ~/.ssh/id_ed25519.pub

    You will get output similar to the following:

    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJx8z8z8z8z8z8z8z8z8z8z8z8z8z8z8z8z8z8z8z your_email@example.com

    Copy this public key content to add it to AtomGit later.

img_1735033556079_78805a.png

Generating RSA SSH Keys​

RSA is a widely supported SSH key type suitable for most scenarios. To ensure security, it is recommended to use a 4096-bit key length (at least 2048 bits).

  1. Enter the command to generate the key

    Run the following command, replacing your_email@example.com with your email address:

    ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
    • -t rsa: Specifies the key type as RSA.
    • -b 4096: Specifies the key length as 4096 bits (recommended).
    • -C "your_email@example.com": Adds a comment, typically using your email address, for easy identification of the key.

  2. Choose the key save location

    After running the command, you will see the following prompt:

    Generating public/private rsa key pair.
    Enter file in which to save the key (/home/user/.ssh/id_rsa):
    • Press Enter to accept the default location (~/.ssh/id_rsa)
    • If you want to customize the save path, enter a new path, such as ~/.ssh/my_custom_key

  3. Set a key password (optional but recommended)

    Next, the system will prompt you to set a password:

    Enter passphrase (empty for no passphrase):
    Enter same passphrase again:

    • Enter a secure password to protect your private key (it is recommended to use a strong password)

    • If you don't need a password, simply press Enter to skip

      Password Function

      After setting a password, you will need to enter it every time you use the SSH key. This prevents unauthorized people from using your private key.

  4. Confirm successful key generation

    If the operation is successful, you will see output similar to the following:

    Your identification has been saved in /Users/.ssh/id_rsa
    Your public key has been saved in /Users/.ssh/id_rsa.pub
    The key fingerprint is:
    SHA256:Ub+LOdZzqYTdq5t+mDAErdkTtzUbnB8VPXJs/cTBDPA your_email@example.com
    The key's randomart image is:
    +---[RSA 4096]----+
    |         ....o==B|
    |        ..o.o.*O=|
    |        .= o.E+*+|
    |        o.+ ... o|
    |        S. ..    |
    |          o* o . |
    |          *o*o+  |
    |         . oo=.. |
    |           .*+.  |
    +----[SHA256]-----+
    • Private Key: ~/.ssh/id_rsa (do not leak it).
    • Public Key: ~/.ssh/id_rsa.pub (can be uploaded to AtomGit).

  5. View the generated key

    You can view the generated public key content using the following command:

    cat ~/.ssh/id_rsa.pub

    Example output:

    ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArV1... your_email@example.com

    Copy this public key content to add it to AtomGit later.

RSA Keys for OpenSSH 6.5 ~ 7.8​

Before OpenSSH 7.8, the default fingerprint of RSA keys was based on MD5, posing a security risk. If you are using OpenSSH 6.5 to 7.8 versions, it is recommended to take the following measures:

  1. Upgrade existing RSA keys

    If you already have an RSA key, you can upgrade it to a more secure OpenSSH format using the following command:

    ssh-keygen -o -f ~/.ssh/id_rsa

  2. Generate new RSA keys

    If you need to generate new RSA keys, you can use the following command:

    ssh-keygen -o -t rsa -b 4096 -C "your_email@example.com"
    • -o: Saves the private key in a more secure OpenSSH format.

Adding SSH Public Key to AtomGit​

Now, you can copy your created SSH key to your AtomGit account. For example, using an ED25519 SSH key, you can follow these steps:

  1. Copy SSH public key content

    Copy your SSH public key from the file where the SSH key is saved. The following commands can save the information of ED25519 to the clipboard of the specified operating system:

    macOS

    pbcopy < ~/.ssh/id_ed25519.pub

    Linux (requires xclip package)

    xclip -sel clip < ~/.ssh/id_ed25519.pub

    Git Bash on Windows

    cat ~/.ssh/id_ed25519.pub | clip

    If you are using an RSA key, replace accordingly.

  2. Log in to AtomGit, go to "Personal Settings" -> "Security Settings" -> "SSH Public Key"

  3. Click "+ SSH Public Key"

  4. In the "Public Key Name" field, add a descriptive name for the public key

  5. Paste the copied public key content into the "Public Key" text box

  6. Click "New" to complete the operation

    img_1735033556079_3f4460.png

提示

If you manually copied the public SSH key, make sure to copy the entire key, which starts with ssh-ed25519 (or ssh-rsa) and ends with your email address.

Testing SSH Connection​

To test whether the SSH key has been correctly added, run the following command in the terminal:

ssh -T git@gitcode.com

When you first connect to AtomGit via SSH, you will be asked whether to trust the AtomGit host address. After confirming yes, AtomGit will be added to the list of trusted hosts:

The authenticity of host 'gitcode.com (121.36.6.22)' can't be established.
ECDSA key fingerprint is SHA256:HbW3g8zUjNSksFbqTiUWPWg2Bq1x8xdGUrliXFzSnUw.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'gitcode.com' (ECDSA) to the list of known hosts.

Once added to the list of known hosts, you will no longer be prompted to verify the authenticity of the AtomGit host. When you run the above command again, you will only receive the Welcome to GitCode, [username] message.

If you do not see the welcome message, you can solve the problem by running ssh in verbose mode using the following command:

ssh -Tv git@gitcode.com

SSH Public Key Fingerprint Announcement​

Public Key Fingerprint​

Here is the public key fingerprint of AtomGit:

SHA256:aTlsy+4ARMC7nWyy5eKIqUkotk8yv7Jd+XXoP4EXj1Y (RSA)

Public Key Entry​

You can add the following SSH key entry to the ~/.ssh/known_hosts file to avoid manually verifying the AtomGit host:

gitcode.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKab7YeXOFdPfVqCOrBaksjT3YTSk/E5FgRGEFBdA1M89ZkGt7syJnFlcdnV6L9j2vCAcHroVdY34oxWFp2AxBBxmxg1oz7JaeKLahqqr67wljfH9ky34eKWrgqnDzgSl/PMZ8vNPDTo1ZfHOwa3pAwdpZVfWUxoB8D8UmGrW49fZKiIv+JM1AbBunE4skkOb+5QZyZs12fnQ8EXTsCgBe1RseKplp7ZVMAn2p5nPcK5NpZ1vU+cu5/H5vl4XNlhCnd8QnyXDrAvhlG3Mo/959K5XDUI7m2pR3fs9Z5BF8ZNRj7uoQyzOuUThbLnIqvhlArPvhyRj+W8sjp+ZlEyxr

Fingerprint Verification Instructions​

The public key fingerprint is used to verify the security of the connection between you and the remote server. When you first connect to AtomGit via SSH, the system will prompt you to confirm the authenticity of the host. You can compare the fingerprint displayed in the prompt with the public key fingerprint announced above; alternatively, you can add the above public key entry to the local ~/.ssh/known_hosts file, after which you will no longer need to manually verify the AtomGit host.

Using SSH Keys with Non-Default Paths​

If you have used a non-default file path for your SSH key pair, configure the SSH client to point to the private SSH key for AtomGit.

You can run the following command to configure it:

eval $(ssh-agent -s)
ssh-add <path to private SSH key>

This configuration will be saved in the ~/.ssh/config file. Here are two examples of SSH keys specifically for AtomGit:

# GitCode
  Host gitcode.com
  Preferredauthentications publickey
  IdentityFile ~/.ssh/gitcode_rsa

# Github instance
  Host github.com
  Preferredauthentications publickey
  IdentityFile ~/.ssh/example_github_rsa

Public SSH keys must be unique for AtomGit since they will be bound to your account. SSH keys serve as the unique identifier when pushing code via SSH, which is why they need to uniquely map to a single user.

Setting Up SSH Keys for Projects​

If you want to use different keys for the code repository you are currently using, you can run the following command in the code repository:

git config core.sshCommand "ssh -o IdentitiesOnly=yes -i ~/.ssh/private-key-filename-for-this-repository -F /dev/null"

This configuration will ignore the SSH agent and requires at least Git 2.10.

Multi-Account SSH Configuration​

The method of setting up SSH keys for each project also applies to using multiple accounts in AtomGit. Additionally, you can distinguish between different accounts by configuring SSH keys in the ~/.ssh/config file. Here is how to do it:

In the ~/.ssh/config file, set aliases for each account and specify the corresponding SSH key file. An example configuration is as follows:

# User1 Account Configuration
Host user_1.gitcode.com
  Hostname gitcode.com
  PreferredAuthentications publickey
  IdentityFile ~/.ssh/example_ssh_key1

# User2 Account Configuration
Host user_2.gitcode.com
  Hostname gitcode.com
  PreferredAuthentications publickey
  IdentityFile ~/.ssh/example_ssh_key2
  • Host: A custom alias (e.g., user_1.gitcode.com), used to distinguish between different accounts.
  • IdentityFile: Specifies the path to the private key file for the corresponding account.
提示

  1. The IdentityFile configuration must be placed inside the Host block and cannot be placed outside of it. If the IdentityFile configuration is outside the Host block, SSH and Git will not correctly recognize the key, resulting in login failure.

  2. Note: The permissions of the private key and public key files should be set to read-only for the user. Run the following command:

    chmod 0400 ~/.ssh/example_ssh_key1
    chmod 0400 ~/.ssh/example_ssh_key1.pub

Next, you can clone a repository using the configured alias. For example, when cloning a repository for user_1, replace gitcode.com with the alias user_1.gitcode.com:

git clone git@user_1.gitcode.com:repo-org/repo.git

If you have already cloned a repository but need to switch accounts, you can use the git remote set-url command to modify the remote URL. For example:

git remote set-url origin git@user_1.gitcode.com:repo-org/repo.git

Configuring SSH Keys in Eclipse​

If you are using Eclipse and the EGit plugin, you can add SSH keys to Eclipse via the EGit User Guide.

Windows System Configuration​

On Windows, you can support Git and SSH through the following methods:

  • WSL (Windows Subsystem for Linux): Install a Linux distribution (such as Ubuntu) and use its Git and SSH client.
  • Git for Windows: Install Git for Windows, which comes with an SSH client.
  • Other tools:
    • Cygwin: An environment for running Linux tools on Windows.
    • PuttyGen: A tool for generating and managing SSH keys.

Troubleshooting​

If the system prompts you to enter a password (e.g., git@gitcode.com's password:) when executing git clone, it indicates that there may be an issue with the SSH configuration. Here are the troubleshooting steps:

  • Ensure that you have correctly generated the SSH key and added the public SSH key to your AtomGit account.
  • Try manually registering your private SSH key using ssh-agent, refer to Using SSH Keys with Non-Default Paths
  • Try debugging the connection by running ssh -Tv git@gitcode.com