# https://devconnected.com/how-to-install-and-enable-ssh-server-on-debian-10/
# ssh-keygen -t ed25519 -C "user@website.com"
# ssh-keygen -o -a 100 -t ed25519 -f ~/.ssh/id_ed25519 -C "john@example.com"
# Generate OpenSSH Private Key id_rsa and Public Key id_rsa.pub (4096, 7680, 15360)
ssh-keygen -t rsa -b 4096 -C "user@website.com"
ssh-keygen -t ed25519 -b 256 -C "comment" -f ~/.ssh/id_ed25519
----------------------------------------------------------
# ENABLE root access during OS install with password but don't enable SSH remote login for 'root'.
# DEBIAN--LOGIN AS ROOT - Adding SUDO
su - root
sudo apt update && sudo apt upgrade
apt install sudo
----------------------------------------------------------
# ADD username to /etc/sudoers right under root user
vi /etc/sudoers
username    ALL=(ALL:ALL)       ALL
----------------------------------------------------------
# vi /etc/sudoers.d/mynewuser
# mynewuser   ALL=(ALL)       NOPASSWD: ALL
# chmod 440 /etc/sudoers.d/mynewuser
----------------------------------------------------------
sudo apt install openssh-server
# /etc/init.d/ssh restart
systemctl enable sshd
systemctl start sshd
# sudo firewall-cmd --add-service=ssh --permanent && firewall-cmd --reload
----------------------------------------------------------
# Switchback to normal user and create .ssh folder & files
cd ~
mkdir .ssh
cd .ssh
touch authorized_keys
cd ~
chmod go-w ~/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
----------------------------------------------------------
# Restart machine, Switchback to existing working machine with SSH authorized_keys installed add public key to authorized_keys
ssh-copy-id -f user@hostname.domain.com
----------------------------------------------------------
# IMPORTANT -DISABLE SSH PASSWORDS - Only uses Public w/Private Keys for SSH. Local Console logins with passwords is still allowed.
su - root
cd /etc/ssh
vi /etc/ssh/sshd_config
PasswordAuthentication no
PermitRootLogin no
[Socket]
SocketProtocol=mptcp

systemctl restart sshd
----------------------------------------------------------
# TO REMOVE OLD KEYS FROM known_hosts file
ssh-keygen -f "/home/privacy/.ssh/known_hosts" -R "192.168.1.124"
----------------------------------------------------------
# SHOW SHA-256 FINGERPRINT
# You can use ssh-keygen. Convert file format first # ssh-keygen -i -m PKCS8 -f pubkey.pem > NEWpubkey.pem
# Next get the fingerprint:ssh-keygen -lf NEWpubkey.pem
# openssl rsa -in pubkey.pem -pubin -outform der | openssl dgst -sha256
----------------------------------------------------------
#AGENT for Private Keys on Linux - MANUAL run ssh-agent and add ssh private key.
eval "$(ssh-agent -s)"
chmod 600 /c/Users/username/Documents/SETTINGS/id_rsa
ssh-add /c/Users/username/Documents/SETTINGS/id_rsa
ssh-add /directory/my_id_rsa
----------------------------------------------------------
# To create a systemd ssh-agent service, you need to create a file in ~/.config/systemd/user/ssh-agent.service because ssh-agent is user isolated.
vi ~/.config/systemd/user/ssh-agent.service
    [Unit]
    Description=SSH key agent
    [Service]
    Type=simple
    Environment=SSH_AUTH_SOCK=%t/ssh-agent.socket
    ExecStart=/usr/bin/ssh-agent -D -a $SSH_AUTH_SOCK
    [Install]
    WantedBy=default.target

vi ~/.config/environment.d/ssh_auth_socket.conf
SSH_AUTH_SOCK="${XDG_RUNTIME_DIR}/ssh-agent.socket"
systemctl --user enable --now ssh-agent

#And, if you are using ssh version higher than 7.2.

    echo 'AddKeysToAgent  yes' >> ~/.ssh/config

# This will instruct the ssh client to always add the key to a running agent, so there's no need to ssh-add it beforehand. Note that when you create the ~/.ssh/config file you may need to run:

chmod 600 ~/.ssh/config
---------------------------------------------------------
# FOR WINDOWS - Add the ssh-agent as a auto-starting Service. KeyPassXC will add the private keys to the agent when it starts.
https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.1.0.0p1-Beta
https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_keymanagement#user-key-generation
# Powershell install
dism /online /Get-Capabilities /Format:Table | findstr -i ssh
Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

dism /online /Remove-Capability /CapabilityName:OpenSSH.Client~~~~0.0.1.0

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent

Get-Service ssh-agent
Status   Name               DisplayName
------   ----               -----------
Running  ssh-agent          OpenSSH Authentication Agent

# List Keys in ssh-agent
ssh-add -l
ssh-add -L

Could be multiple things; here are just a couple. 1. If you were using authorized_keys, were they copied to new user on Rocky? 2. Is sshd enabled on Rocky? systemctl status sshd 3. Firewall opened on Rocky? firewall-cmd --add-service=ssh --permanent 4. Permissions need reset on .ssh & authorized_keys; happens a lot more than you may realize. 5. Hopefully not root ssh login? Check /etc/ssh/sshd_config PasswordAuthentication PermitRootLogin Values 6. Is SSH Private Key added to SSH Agent?