ssh-keyup

Set up passwordless SSH on Raspberry Pi, NVIDIA Jetson or any Linux device in one command.

Tired of juggling ssh-keygen, ssh-copy-id (missing on Windows) and ~/.ssh/config edits every time you set up a new device?

ssh-keyup handles all three in one interactive session.

Quickstart

Install globally with pip:

pip install ssh-keyup

ssh-keyup   # ready to use anywhere

Tip: If ssh-keyup is missing or runs an old version after install, new script sits in a folder outside PATH (pip warns about this). Add that folder to PATH, or install with pipx instead:

pipx install ssh-keyup

Or run directly without installing:

git clone https://github.com/Kurokesu/ssh-keyup.git
cd ssh-keyup
python ssh_keyup.py   # Windows
python3 ssh_keyup.py  # Linux

Follow prompts, enter remote password once and you're done. Alias now works in anything that reads ~/.ssh/config:

Terminal:

ssh mypi   # no password, ever again

VSCode: Remote - SSH works out of the box. Press Ctrl+Shift+P, select Remote-SSH: Connect to Host and pick your alias for a full IDE on the device, no password:

Usage

Skip prompts

ssh-keyup pi@192.168.1.23 mypi   # user, host and alias in one go

Flags (--host, --user, --alias) work too, see ssh-keyup --help.

Set up a fleet

for host in 192.168.1.10 192.168.1.11 192.168.1.12; do
  ssh-keyup pi@$host
done

Manage entries

List or remove entries ssh-keyup manages:

ssh-keyup --list
ssh-keyup --remove mypi   # deletes its key pair too

Prerequisites

Python 3.8+ and OpenSSH tools (ssh, ssh-keygen) in PATH.

• Windows 10/11: Python from python.org or Microsoft Store. OpenSSH Client via Settings > Optional Features or Git for Windows.
• Linux: sudo apt install python3 openssh-client (usually pre-installed).

How it works

flowchart LR
    run["ssh-keyup"] --> check["check connection"]
    check --> gen["generate ed25519 key<br/>~/.ssh/id_ed25519_mypi"]
    gen --> deploy["deploy public key<br/>target: ~/.ssh/authorized_keys"]
    deploy --> config["update ssh config<br/>~/.ssh/config"]

Features

• Works on Windows OpenSSH, where ssh-copy-id does not exist
• Never touches your password. Only the public key is piped over SSH and OpenSSH prompts for the password itself
• One Ed25519 key per device (~/.ssh/id_ed25519_<alias>), not one key reused everywhere
• Deploys in a single SSH session, one password prompt total
• Adds a named entry to ~/.ssh/config, works instantly with ssh <alias> and VSCode Remote SSH
• Checks host is reachable first, so typos surface before keys exist
• Recovers from host key mismatches after a reflash
• Entry management, list or retire devices without leaving stale keys behind
• Zero dependencies, standard library plus system OpenSSH

FAQ

Why not do it by hand?

Usual commands for passwordless SSH from Windows:

ssh-keygen -t ed25519
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh pi@raspberrypi.local "cat >> ~/.ssh/authorized_keys"
notepad $env:USERPROFILE\.ssh\config   # then add a Host block by hand

Works once. Same key lands on every device, ~/.ssh keeps default permissions that sshd may reject and each new device means another config edit.

Why not ssh-copy-id?

ssh-copy-id appends a key to authorized_keys and stops there. Windows OpenSSH does not ship it at all.

How do I fix "REMOTE HOST IDENTIFICATION HAS CHANGED"?

Reflashing creates a new host key, so next ssh refuses to connect:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
...
Offending ECDSA key in ~/.ssh/known_hosts:3
Host key verification failed.

Run ssh-keyup again. It detects a changed key, shows new fingerprint for confirmation, clears stale known_hosts entry with ssh-keygen -R and redeploys. Usually a reflash is behind it, but this warning can also mean a real man-in-the-middle, so ssh-keyup asks instead of trusting silently.

Does --remove clean up entries on the device?

No. It deletes local key pair and ~/.ssh/config entry. Line in the device's authorized_keys stays until removed there.

What devices are supported?

Anything reachable over SSH: Raspberry Pi, NVIDIA Jetson, Orange Pi, VMs, servers.