Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have been setting up a lot of virtual machines for different projects I'm working on. Instead of using ssh-keygen on each machine, I've been copying my id_rsa file from one of my machines to all the other ones I've been setting up.

This way I don't need to upload my rsa_id.pub for each new machine to my server or add them to other servers I want to ssh into.

Is this practice a terrible idea? Should I just be generating a new key for each VM?

share|improve this question
    
yes, indeed it is. –  Sirex Apr 8 '11 at 10:22

2 Answers 2

up vote 2 down vote accepted

SSH has a feature called "agent forwarding". If it's enabled and if you have ssh-agent running on machine A, with your key loaded into it, then you can SSH to machine B, from B to C, from C to ..., without having to copy the private key anywhere except machine A.

This works very well if you have your own workstation (A) from which you connect to all [virtual] machines.


machineA$ ssh-add
Enter passphrase for /home/grawity/.ssh/id_rsa:
Identity added: /home/grawity/.ssh/id_rsa

machineA$ ssh -A machineB

machineB$ ssh -A machineC

machineC$ ssh-add -l
4096 50:08:e7:0c:0e:7b:2b:47:88:9e:d5:11:7b:f6:ce:f5 /home/grawity/.ssh/id_rsa (RSA)

You can activate it permanently by adding ForwardAgent=yes under the apropriate Host line (Host * for all connections) in ~/.ssh/config.

share|improve this answer
    
Thanks I'll give that a look –  kriegar Apr 8 '11 at 22:26

id_rsa is your private key.

Are you doing this in addition to adding id_rsa.pub to all of your '~/.ssh/known_hosts'? If not then it makes little sense as you still won't be able to ssh between them without passwords.

Personally I would generate separate keys for each user & host as required in order to maintain fine grained access, using agent forwarding for your own administration.

share|improve this answer
    
Ya, I added the rsa_id.pub to the known_hosts. –  kriegar Apr 8 '11 at 17:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.