What significance does the user/host at the end of an SSH public key file hold?
This field is a comment, and can be changed or ignored at will. It is set to
[email protected] by default by
sshd(8) man page describes the format of a public key thus:
Public keys consist of the following space-separated fields: options, keytype, base64-encoded key, comment. . . . The comment field is not used for anything (but may be convenient for the user to identify the key).
ssh-keygen(1) man page says:
The key comment may be useful to help identify the key. The comment is initialized to “[email protected]” when the key is created, but can be changed using the -c option.
This is briefly explained in manual page for
sshd(8) in section about authorized keys:
Protocol 2 public key consist of: options, keytype, base64-encoded key,
openssh context of authorized keys, there is only meaning of comment. But there are SSH implementation, that give the meanings to this part, as for example SSH implementation in LANCOM modems is using this comment as a username for which the key is valid.
As others have pointed out, it's a comment to allow you to identify which key is which.
When looking at a single key in eg
id_rsa.pub it doesn't make a great deal of difference but when looking at a potentially long list of keys, such as what you have in the
authorized_keys file, it is very helpful to be able to easily identify which key is which.
ssh-keygen's default is
[email protected], which for typical use-cases is a clear identifier of which key it is (
[email protected] would not be).
Very, very simple: Me and you are humans using a machine. So looking at this example you posted:
ssh-rsa [piles of gobbledygook]…CA9gyE8HRhNMG6ZDwyhPBbDfX [email protected]
A machine can read this:
ssh-rsa [piles of gobbledygook]…CA9gyE8HRhNMG6ZDwyhPBbDfX
A human can read this comment:
People tend to forget that even though things might look complicated on computer systems, they could actually be tons more complicated if the code was designed only for machine consumption. I mean look at obscured malware code. Once you decode it and format it, it’s human readable. But someone had to go out of their way to make it hard for humans to read.
By default all types of coding and configuration files on a computer system are structure for human consumption because… We are humans using machines and machines don’t need things like:
- Variables and functions written in a human readable language.
So the comment is meant for you and me and nobody else. It would most likely work without a comment. But that one time something is not working at 3:00am and you are hunting for the right public key, you’re going to wish/dream/pray the comment is there.