Keychain Management

Generate, import, and manage SSH keys, certificates, and identities

Overview

The Keychain is Netcatty’s centralized storage for SSH keys, certificates, and authentication identities. It provides a secure vault for managing credentials across all your hosts.

Accessing the Keychain

1. Click Keychain in the sidebar
2. Or press Cmd+Shift+K (Mac) / Ctrl+Shift+K (Windows/Linux)

SSH Keys

SSH keys are the foundation of secure authentication in Netcatty.

Key Structure

SSHKey · object

Show Properties

id · string · required

Unique identifier (auto-generated)

label · string · required

Display name for the key

type · KeyType · required

Key algorithm: RSA, ECDSA, or ED25519

keySize · number

Key size in bits (RSA: 4096/2048/1024, ECDSA: 521/384/256)

privateKey · string · required

Private key in OpenSSH or PEM format

publicKey · string

Public key

certificate · string

SSH certificate (for certificate-based auth)

passphrase · string

Passphrase to decrypt the private key

savePassphrase · boolean

Whether to store the passphrase securely

source · KeySource · required

How the key was created: generated or imported

category · KeyCategory · required

Key category: key, certificate, or identity

created · number · required

Timestamp when key was added

Generating SSH Keys

Create new SSH key pairs directly in Netcatty.

UI Workflow

1. Navigate to Keychain
2. Click Generate button
3. Configure key settings:
   • Label: Descriptive name (e.g., “Production Deploy Key”)
   • Key Type: Select algorithm (ED25519 recommended)
   • Key Size: Select bit length (RSA/ECDSA only)
   • Passphrase: Optional but recommended
4. Click Generate
5. Netcatty creates the key pair using system crypto libraries

ED25519 (Recommended)

Advantages:

• Highest security
• Fast operations
• Small key size

When to Use:

• New servers running OpenSSH 6.5+
• Modern cloud environments
• Any production deployment

Settings:

• No key size selection needed (fixed at 256 bits)

RSA

Advantages:

• Universal compatibility
• Works with older systems

When to Use:

• Legacy systems
• Maximum compatibility needed

Recommended Settings:

• Key Size: 4096 bits
• Minimum: 2048 bits

ECDSA

Advantages:

• Good security
• Smaller than RSA

When to Use:

• Compatibility between ED25519 and RSA

Recommended Settings:

• Key Size: 521 bits

Generated Key Example

{
  "id": "key-abc123",
  "label": "Production Deploy",
  "type": "ED25519",
  "privateKey": "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAA...\n-----END OPENSSH PRIVATE KEY-----",
  "publicKey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... Generated By netcatty",
  "passphrase": "your-passphrase",
  "savePassphrase": true,
  "source": "generated",
  "category": "key",
  "created": 1710432000000
}

Netcatty uses your system’s native SSH key generation libraries (via Electron backend) for maximum security.

Importing SSH Keys

Import existing keys from files or clipboard.

Import Methods

Paste Content

1. Click Import in Keychain
2. Enter a Label
3. Paste Private Key content
4. (Optional) Paste Public Key
5. (Optional) Paste Certificate
6. Enter Passphrase if encrypted
7. Click Save

File Upload

1. Click Import in Keychain
2. Click Import from File
3. Select your private key file
4. Netcatty auto-detects:
   • Key type (RSA/ECDSA/ED25519)
   • Filename as label
5. Review and click Save

Drag & Drop

1. Open Import panel
2. Drag private key file into the drop zone
3. Netcatty auto-populates fields
4. Review and click Save

Supported Formats

• OpenSSH Format (modern, recommended)

  -----BEGIN OPENSSH PRIVATE KEY-----
  b3BlbnNzaC1rZXktdjEAAAAA...
  -----END OPENSSH PRIVATE KEY-----
  

• PEM Format (legacy)

  -----BEGIN RSA PRIVATE KEY-----
  MIIEpAIBAAKCAQEA...
  -----END RSA PRIVATE KEY-----
  

• PKCS8 Format

  -----BEGIN PRIVATE KEY-----
  MIIEvQIBADANBgkqhkiG9w0...
  -----END PRIVATE KEY-----
  

Never import private keys from untrusted sources. Always verify the source and regenerate if in doubt.

Managing Keys

Viewing Keys

Grid View (default):

• Visual cards showing key labels
• Type indicators (Key/Certificate)
• Quick actions on hover

List View:

• Compact rows
• More keys visible at once
• Sortable columns

Key Actions

View Details

Click a key to view:

• Full public key
• Key fingerprint
• Creation date
• Associated hosts

Edit

Modify:

• Label
• Private key content
• Public key
• Certificate

Export to Host

Automatically add public key to a remote server’s ~/.ssh/authorized_keys

Copy Public Key

Copy public key to clipboard for manual distribution

Delete

Remove key from keychain (hosts using this key will prompt for re-selection)

Exporting Public Keys to Hosts

Netcatty can automatically deploy your public key to remote servers.

Workflow:

1. Click on a key in Keychain
2. Click Export to Host
3. Select target host
4. Configure export settings:
   • Location: Directory (default: .ssh)
   • Filename: Target file (default: authorized_keys)
   • Script: Custom deployment script
5. Click Export and Attach

What Happens:

• Netcatty connects to the host (using existing credentials)
• Runs export script via SSH
• Default script:
  DIR="$HOME/.ssh"
  FILE="$DIR/authorized_keys"
  if [ ! -d "$DIR" ]; then
    mkdir -p "$DIR"
    chmod 700 "$DIR"
  fi
  if [ ! -f "$FILE" ]; then
    touch "$FILE"
    chmod 600 "$FILE"
  fi
  echo $PUBLIC_KEY >> "$FILE"
  
• Automatically updates host to use this key for future connections

The export script is customizable for non-standard setups (e.g., centralized authentication systems).

SSH Certificates

SSH certificates provide enhanced security and centralized management.

Importing Certificates

1. Click Import in Keychain
2. Enter Label
3. Paste Private Key
4. Paste Certificate in the Certificate field
5. Click Save

The key is automatically categorized as a certificate.

Certificate Structure

A certificate key includes:

• Private key (same as regular SSH key)
• Certificate signed by a CA
• Certificate contains:
  • Validity period
  • Principals (allowed usernames)
  • Extensions (permissions)

Using Certificates

{
  "hostname": "server.example.com",
  "username": "deploy",
  "authMethod": "certificate",
  "identityFileId": "cert-key-id"
}

The remote server must trust the CA that signed your certificate. This is configured in /etc/ssh/sshd_config with TrustedUserCAKeys.

Identities

Identities combine username and authentication method for reuse across hosts.

Identity Structure

Identity · object

Show Properties

id · string · required

Unique identifier

label · string · required

Display name (e.g., “Production Deploy”)

username · string · required

SSH username

authMethod · IdentityAuthMethod · required

password, key, or certificate

password · string

Password (for password auth)

keyId · string

Reference to SSH key (for key/certificate auth)

created · number · required

Timestamp

Creating Identities

1. Navigate to Keychain
2. Click the dropdown on Key filter
3. Select New Identity
4. Configure:
   • Label: “Deploy User”
   • Username: deploy
   • Auth Method: Key
   • SSH Key: Select from dropdown
5. Click Save

Using Identities

Attach an identity to multiple hosts:

{
  "hostname": "web-01.example.com",
  "identityId": "deploy-identity"
}

Benefits:

• Update credentials in one place
• Enforce consistent authentication across server groups
• Simplify host configuration

Searching and Filtering

Search Bar

Filter keys by:

• Label
• Key type
• Public key content

Filter Tabs

• Key: Generated and imported keys
• Certificate: Keys with certificates attached

Click the dropdown arrow on filter tabs for quick actions:

• Generate new key
• Import key
• Create identity

Keyboard Shortcuts

Action	Mac	Windows/Linux
Open Keychain	Cmd+Shift+K	Ctrl+Shift+K
Generate Key	(in dropdown)	(in dropdown)
Import Key	(in dropdown)	(in dropdown)
Search	Start typing	Start typing

Security Best Practices

Key Generation

• Always use ED25519 for new keys unless compatibility requires RSA
• Use 4096-bit RSA keys minimum
• Never reuse keys across environments (dev/staging/prod)

Passphrase Protection

• Always set passphrases on private keys
• Use strong, unique passphrases (20+ characters)
• Enable “Save Passphrase” only on secure, personal devices

Key Storage

• Keep private keys out of cloud storage
• Don’t commit keys to version control
• Use different keys for different purposes

Key Rotation

• Rotate keys every 90-180 days
• Immediately rotate if compromised
• Remove old keys from authorized_keys

Troubleshooting

Key Format Not Recognized

Solution: Convert to OpenSSH format:

ssh-keygen -p -m PEM -f ~/.ssh/old_key
ssh-keygen -p -m RFC4716 -f ~/.ssh/old_key

Export to Host Fails

Possible Causes:

• No existing authentication method configured
• Server doesn’t allow password auth or current key

Solution:

1. Configure password or another key for initial access
2. Retry export
3. Check SSH logs on server: /var/log/auth.log

Passphrase Not Saving

Solution:

• Ensure your OS keychain/credential manager is accessible
• Mac: Check Keychain Access app
• Windows: Check Credential Manager
• Linux: Ensure libsecret is installed

Related Resources

Authentication

Configure authentication methods for hosts

Host Configuration

Advanced host settings and customization