Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Alright, so I'm looking at securing a new server I have acquired for some very basic web hosting. Part of that is to turn off password logins and go with an SSH Key only login. I also have multiple computers that I'm going to need to make this work.

I see when I generate a key it includes my username and hostname for the machine I'm currently on. Is there a way to make a generic key that I can use across multiple computers? Or is it better to create multiple keys, one for each computer, and add each to the authorized keys file?

The next thing is using the key with the iOS app Prompt. It allows you to store a key but I have no idea how exactly it works with regard to using a key generated using a particular user/host from another machine. I'm guessing not many others will know, but this is part of the reason I ask. How would you more savvy users set this up?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

That username and password stored in SSH public keys is actually only a comment. You can change it to anything you want, and it especially is not used to enforce logins from any particular host.

For my own SSH keys, I don't necessarily have one per computer/virtual host: perhaps my personal computers at home might share an SSH key. However, I try to consider which machines are the most likely to be compromised, and give them their own key. For example my shared hosting boxes, laptop, etc, all have their own key. If anything bad happened to them, I can immediately remove that one key from my other machines' list of authorized keys, and then carry on mostly unaffected otherwise.

share|improve this answer
    
Do you know how to easily change it via the commandline? Or just edit the key after it's generated? I'm guessing it's the -C option? –  gks May 30 '11 at 19:02
    
It's just a text file ;) you can edit it with anything: vim, sed, etc Edit: yes, the -C option will also let you do it when you generate the key –  spectre256 May 30 '11 at 19:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.