Generate Strong SSH Keys and Save Them Securely with Python

import os
import stat
from pathlib import Path
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.backends import default_backend

def generate_ssh_keypair(key_path: str = "id_rsa", passphrase: str = None):
    """Generate a 4096-bit SSH key pair and save securely."""
    key = rsa.generate_private_key(
        public_exponent=65537,
        key_size=4096,
        backend=default_backend()
    )

    private_key_path = Path(key_path)
    public_key_path = private_key_path.with_suffix(".pub")

    # Save private key with restricted permissions (owner read/write only)
    encryption = serialization.BestAvailableEncryption(passphrase.encode()) if passphrase else serialization.NoEncryption()
    private_bytes = key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.OpenSSH,
        encryption_algorithm=encryption
    )
    private_key_path.write_bytes(private_bytes)
    private_key_path.chmod(stat.S_IRUSR | stat.S_IWUSR)  # 0o600

    # Save public key
    public_bytes = key.public_key().public_bytes(
        encoding=serialization.Encoding.OpenSSH,
        format=serialization.PublicFormat.OpenSSH
    )
    public_key_path.write_bytes(public_bytes)
    public_key_path.chmod(stat.S_IRUSR | stat.S_IWUSR)

    print(f"SSH key pair saved: {private_key_path} and {public_key_path}")

if __name__ == "__main__":
    generate_ssh_keypair(passphrase="my_secure_passphrase")