Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm confusing myself on some ssh key-based authentication.

Let's say I have:

Host A:
user tom

Host B:
user shared

I want to SSH from Host A, as user shared, into Host B.

Would I have to copy the shared user's private key to my ssh directory and then use the -I parameter or setup an SSH config file so that when I ssh to that host as user shared, the shared user's private key is used?

There's not a way to do this without copying the private key is there? I don't think so, but I'd obviously like to avoid copying around private keys if I can.

share|improve this question
up vote 0 down vote accepted

You need to populate the ~/.ssh/authorized_keys file on Host B with the public keys of all the users you want to have access to the shared account. Only the client needs the user's private key. The server only needs to know the public keys which are allowed to connect to a given account.

There is rarely a need for users to share private keys (the well-known Vagrant private key is an illustrative exception), or to place the users' private keys on the server. Each private key should be unique to each user and should remain on his or her client machine. Even if you disregard this best practice, you still don't need to put the shared-user's private key on the server; you just need to distribute a copy of the private key to every user who will be using that key to connect to the shared account.

share|improve this answer

If you SSH from your laptop to Host A you can store private key locally and use agent forwarding (ssh -A host_a).

share|improve this answer

Doing this on Host A:

cat ~tom/.ssh/tom_public_key | ssh shared@host-b 'cat >> .ssh/authorized_keys'

Let's you do (again on Host A):

ssh -i ~tom/.ssh/tom_private_key shared@host-b

In the first line you copy Tom's public key from Host A (host-a:~tom/.ssh/tom_public_key) to Host B into the Shared-User's authorized_keys-file (host-b:~shared/.ssh/authorized_keys), then you can connect (second line) from A to B without password:

You can have multiple public keys in the the authorized_keys-file (one per line) and use the same public key for multiple remote hosts. You can also use the same private key on multiple machines but I'd call thad bad practice.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .