How to verify if a public and private RSA SSH key match?

Introduction

There may be a time where you wish to verify a newly created public and private SSH key are valid and is matched pair. This can be shown on the command-line.

This article is to be used in conjunction with 'Managing root SSH Keys for cPanel Support' article. 

Procedure

1. Log in the server as 'root' using SSH, or use the WHM: Terminal feature.

2. Change into the /root/.ssh/ directory on the server.

Command:

cd /root/.ssh/

3. Use the command 'ls -al' to list all files in the directory, and locate your private/public keypair you wish to check.

Our example uses a test server.

Command:

# ls -al
-rwx------@ 1 donell staff 3401 Aug 13 11:40 id_rsa.     <--private key
-rwxr--r--@ 1 donell staff 758 Aug 13 11:40 id_rsa.pub   <-- public key
-rwx------@ 1 donell staff 1843 Mar 17 2019 cptest       <--private key
-rwxr--r--@ 1 donell staff 414 Mar 17 2019 cptest.pub    <-- public key

We will use 'cptest' and 'cptest.pub' in our example.

4. Use the following command, to test both files. The output of the command will show the 'signature' of both files. When the 'signature' matches, they show the public key and private key are both valid and match.

# ssh-keygen -l -f cptest
2048 SHA256:REDACTED cptest@domain.tld (RSA)

# ssh-keygen -l -f onering.pub
2048 SHA256:REDACTED cptest@domain.tld (RSA)

5. That's it.

The REDACTED section above contains the signature. It will be viewable. Please do not share it with others.

Please use caution when using the ssh-keygen command, as it can overwrite your present file if the command flags are not used properly.