What exactly can someone do with my Private Key after they used my laptop to create a SSH Public Key?
Nothing.
If that is the the only thing they did while using your laptop, nothing. Simply creating a keypair does not automatically grant any access, to either the laptop itself or any other system.
You need to explicitly configure remote systems (including your laptop) to accept that specific private key for authentication (typically by adding the associated public key to an ~/.ssh/authorized_keys
file) before that private key will grant access and becomes useful.
Adding your public key typically requires password-based access to the account first (and potentially additional dual/multi-factor authentication methods).
- Simply delete that key pair (to prevent you from starting to use it)
- Potentially they could have added that public key to the
~/.ssh/authorized_keys
file on your laptop (that is one place somebody using your laptop could have added the public key they created without knowing your password). Check and empty that file.
- Generate a new SSH key pair when you want to start key based authentication.
Note: When somebody gets a copy of a private key you've been actively using that becomes a different scenario...