Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been setting up a lot of virtual machines for different projects I'm working on. Instead of using ssh-keygen on each machine, I've been copying my id_rsa file from one of my machines to all the other ones I've been setting up.

This way I don't need to upload my for each new machine to my server or add them to other servers I want to ssh into.

Is this practice a terrible idea? Should I just be generating a new key for each VM?

share|improve this question
yes, indeed it is. – Sirex Apr 8 '11 at 10:22
up vote 2 down vote accepted

SSH has a feature called "agent forwarding". If it's enabled and if you have ssh-agent running on machine A, with your key loaded into it, then you can SSH to machine B, from B to C, from C to ..., without having to copy the private key anywhere except machine A.

This works very well if you have your own workstation (A) from which you connect to all [virtual] machines.

machineA$ ssh-add
Enter passphrase for /home/grawity/.ssh/id_rsa:
Identity added: /home/grawity/.ssh/id_rsa

machineA$ ssh -A machineB

machineB$ ssh -A machineC

machineC$ ssh-add -l
4096 50:08:e7:0c:0e:7b:2b:47:88:9e:d5:11:7b:f6:ce:f5 /home/grawity/.ssh/id_rsa (RSA)

You can activate it permanently by adding ForwardAgent=yes under the apropriate Host line (Host * for all connections) in ~/.ssh/config.

share|improve this answer
Thanks I'll give that a look – kriegar Apr 8 '11 at 22:26

id_rsa is your private key.

Are you doing this in addition to adding to all of your '~/.ssh/known_hosts'? If not then it makes little sense as you still won't be able to ssh between them without passwords.

Personally I would generate separate keys for each user & host as required in order to maintain fine grained access, using agent forwarding for your own administration.

share|improve this answer
Ya, I added the to the known_hosts. – kriegar Apr 8 '11 at 17:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .