Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm a little bit confused about setting up a password-less login for multiple machines to begin with, but I think I could do it from scratch. The problem is I already have it set up for one machine and I don't want that to be blown away when I try to set it up for the other machine. Let's clarify:

  • Machine A: the machine I'm connecting from
  • Machine B: the machine I'm connecting to. Password required
  • Machine C: the machine I'm connecting to. Password-less ssh

I have read some tutorials on setting up password-less ssh to a certain site, but they usually start with "move id_rsa out of the way so it doesn't get blown away," but then at the end of the tutorial it's not moved back. If I had no help at all, here is what I would do:

  1. Log into B
  2. ssh-keygen -t rsa -f ~/id_rsa.other
  3. scp id_rsa.other.pub A:~/.ssh
  4. echo "Host A \n Identity File ~/.ssh/id_rsa.other" > ~/.ssh/config

(Note that I realize these commands may not be exactly correct, but this is just the idea).

What I'm not quite clear on is if I need to update the config for A, B, or both. I'm fairly certain to do a password-less login from A to B, it is A that needs the public key .. but I also suppose I need B to use the correct id_rsa file for that public key. Finally, I don't want the password-less login for C to be affected at all .. it's using id_rsa. Am I going wrong anywhere?

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

It sounds like you're connecting A to B or A to C, right? (not A to B and then B to C)

If so, then you ust need to copy your id_rsa.pub to B and also to C.

The modification of the ~/.ssh/config file you have in step 4 in your sequence is needed if you don't use the standard ~/.ssh/authorized_keys file.

Here's what I would do (after generating the id_rsa and id_rsa.pub)...

  1. Copy id_rsa.pub (using scp, using password prompt) to B and to C
  2. Log into B - mv id_rsa.pub ~/.ssh/authorized_keys
  3. Log into C - mv id_rsa.pub ~/.ssh/authorized_keys

The private key is kept on A. You can use the same private key/public key combination to connect to more than one machine.

If, for some reason, you have multiple public keys for the user on B or C, you can append them to the end of the authorized_keys file.

share|improve this answer
    
Yes you're exactly right .. I think this is what I need to do, but C is already set up properly (it already has the public key it needs I think .. can't check for sure since it doesn't allow shell access, but I can scp to it at least). So I guess I really only need to do steps 1 and 2. I'll accept if this works. –  Explosion Pills Mar 26 '12 at 17:14
    
Here's the thing: the id_rsa.pub on A has a pass phrase that I don't want for B .. so I guess I can just generate another id_rsa.pub and just concatenate it. Does ssh-keygen let you do that automatically, or do I have to create a new key file and concatenate manually? –  Explosion Pills Mar 26 '12 at 18:39
    
The .pub is a public key file. The public key is meant to be spread around. It's really the private key on A that is protected by the pass phrase. You type in your pass phrase to verify that you are authorized to use the local private key. When A is negotiating the connection to B or C, it doesn't pass the pass phrase and, I assume, doesn't pass the private key but only receives the public key. Try running ssh -v B or ssh -vv B to see more information about the authentication negotiation. –  Doug Harris Mar 26 '12 at 19:01
    
More discussion of the pros and cons of multiple public keys in this question –  Doug Harris Mar 26 '12 at 19:03
    
Just a little hint from me because this got edited three minutes ago: instead of scp the pubkey you can just run ssh-copy-id B and the standard pubkey will be sent to B. If you need you can add the parameter -i <pubkey-file> if you have multiple keys. –  noggerl Oct 16 '13 at 21:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.