Each user has the ability to create his or her own set of private and public keys. It doesn't matter whether the user's client machine is running Linux, MacOS, or Cygwin on Windows. In all three cases, the procedure is exactly the same. To demo, I'll create keys on my OpenSUSE workstation and transfer the public key to one of my virtual machines. It doesn't matter which virtual machine I use, but since I haven't shown much love to the CentOS machine lately, I'll use it.
I'll begin by creating the keys on my OpenSUSE workstation:
donnie@linux-0ro8:~> ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/donnie/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/donnie/.ssh/id_rsa.
Your public key has been saved in /home/donnie/.ssh/id_rsa.pub.
The key fingerprint is:
SHA256:oqDpCvAptbE8srN6Z4FNXxgkhPhjh1sEKazfMpxhVI8 donnie@linux-0ro8
The key's randomart image is:
+---[RSA 2048]----+
|...*+.. |
|o.+ .+. |
|.+ oE .o |
|. B + . . |
|.=+% ...S |
|.*O*+... |
|* Bo.. |
|++..o |
|B= o |
+----[SHA256]-----+
donnie@linux-0ro8:~>
There are several different types of keys that you can create, but the default 2048-bit RSA keys are considered as plenty strong enough for the foreseeable future. The private and public SSH keys work the same as we saw with GPG. You'll keep your private keys to yourself, but you can share the public key with the world, if you so desire. In this case though, I'm only going to share my public key with just one server.
When prompted for the location and name of the keys, I'll just hit Enter to accept the defaults. You could just leave the private key with a blank passphrase, but that's not a recommended practice.
/home/donnie/.ssh/donnie_rsa
In the .ssh directory in my home directory, I can see the keys that I created:
donnie@linux-0ro8:~/.ssh> ls -l
total 12
-rw------- 1 donnie users 1766 Nov 2 17:52 id_rsa
-rw-r--r-- 1 donnie users 399 Nov 2 17:52 id_rsa.pub
-rw-r--r-- 1 donnie users 2612 Oct 31 18:40 known_hosts
donnie@linux-0ro8:~/.ssh>
The id_rsa key is the private key, with read and write permissions only for me. The id_rsa.pub public key has to be world-readable.