SSHEXPORT(1)

📦
version 2.4 · 2 versions
, in fedora 43

✨ SSHEXPORT(1) ✨

okay bestie, welcome to the manual page for sshexport — it lives in section 1 of the Internet manual, and it's about to be your new fave 💖

🌸 NAME 🌸

sshexport — install ssh public keys on remote servers 🦋

🎀 SYNOPSIS 🎀

sshexport [-h] [-c] [-p port] [-r] [-d] [-v] name@host...

💅 DESCRIPTION 💅

So this script's whole thing is trying to export your ssh public keys out to the sites you name. If it can't find any key pairs to export, it will literally walk you through generating them — no stress, we hold your hand 🫶

It handles all the fiddly little details for you, like:

  • remembering the ssh keyfile names
  • updating authorized_keys
  • making sure your local and remote permissions are correct

And if it has to change anything? It tells you. Transparency queen 👑

Every name@host argument is the name of a host where your public keys should be installed. Here's the tea: if the argument contains an @, the part before the @ gets clipped off and used as the login name. If there's no @? Then your local login name is used. periodt.

Note: this script does not parse your ssh configuration. So if you've specified a different remote user in your config, this script will not know that 😭 You can use the user@host syntax to force the remote username. iykyk.

On any remote Linux system using selinux, the security context of root's authorized_keys is restored whenever it is modified or deleted. (iconic behaviour honestly)

🌈 RECORDING REMOTE KEY LOCATIONS 🌈

If either of these files exists:

  • ~/.config/sshexport
  • ~/.ssh/sshexport.rc

…then the places where you install keys will be recorded in it, along with the password used to access the host and the port (if it's non-default). Slay 💅

That record also gets updated when you use the check option, so you can use that option to check sites where you may have previously installed keys and add them to the list. And entries get edited when you delete remote keys — the key is deleted, but not the password and port information.

Beware, bestie: if your account is cracked, this record will offer the intruder a menu of other systems to attack, escalating security risks. 💀 Not the vibe we want.

So to enable the recording feature, you must explicitly create ~/.ssh/sshexport.rc or ~/.config/sshexport.rc using touch(1) or some other means. This tool will not create the file for you. fr fr, it's on you.

Also — it checks permissions on these files at startup and bails out with a message if they are not limited to the owning user. Security first, always 🧚

⭐ OPTIONS ⭐

Invoked with the -h option, the program prints a usage summary and exits.

Invoked with the -c option, the program checks your local and remote ssh configuration for problems without changing anything (except that your record of where you have installed keys is updated).

The -p option allows you to set a port number, overriding the default 22. This may be useful if you have a firewall and port forwarding setup. Port numbers are recorded if you have recording set up.

Invoked with the -d option, the program deletes any public keys under the specified login at the specified host. The password and the -p option need not be specified if an entry was recorded for this host. The configuration entries for any such keys are also removed, but not port and password information.

The -r option force-installs your keys on all sites recorded in your installation log. By removing your keys (to force a key pair generation) you can ship new keys to all sites. chef's kiss 👑

The -v option says to report all commands and responses during the session. It's mainly useful for debugging.

Here's the bullet list version, for my list-loving besties:

  • -h — prints a usage summary and exits
  • -c — checks your local and remote ssh configuration for problems without changing anything (except that your record of where you have installed keys is updated)
  • -p port — set a port number, overriding the default 22. May be useful if you have a firewall and port forwarding setup. Port numbers are recorded if you have recording set up.
  • -d — deletes any public keys under the specified login at the specified host. The password and the -p option need not be specified if an entry was recorded for this host. The configuration entries for any such keys are also removed, but not port and password information.
  • -r — force-installs your keys on all sites recorded in your installation log. By removing your keys (to force a key pair generation) you can ship new keys to all sites.
  • -v — report all commands and responses during the session. Mainly useful for debugging.

🦋 FILES 🦋

Sites where keys have been installed may be recorded in ~/.sshexport or ~/.config/sshexport. (the second location is preferred if ~/.config exists.) 💜

🌸 REQUIREMENTS 🌸

sshexport was written in Python 2.2a1. It will not work under Python 1.5.2. (yes, really, we're old-school like that 🙈)

💀 BUGS 💀

This program relies on ptys to work correctly in combination with exec, but some implementations (notably under FreeBSD) don't. Suspect this if you see termination with the message:

"Remote ls returned empty string, bailing out"

If you encounter this or any other bug, the first thing to do is run with -v and see if that clarifies matters. If not, send the maintainer a session transcript. 🫶

🔥 SEE ALSO 🔥

👑 AUTHOR 👑

Eric S. Raymond <esr@thyrsus.com>.

There is a project web page at http://www.catb.org/~esr/sshexport/. 🌈

and that's the whole page bestie, mwah 💅 this was sshexport from the Internet manual, dated 07/25/2025 — go forth and install those keys, you absolute main character ✨

📦 where this page comes from