Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a server running Ubuntu. I installed openssh-server and wanted to use ssh key for login purposes. Everything works fine except one thing. On Ubuntu's community site is written "This massively improves your security, but makes it impossible for you to connect to your own computer from a friend's PC without pre-approving the PC [...]" (

I created the key pair on my server/at serverside. Then I added the public key to the authorized_keys and transfered the private key to my client pc and deleted the private key from server.

I'm able to log in from my pc with the private key. But I'm also able to login from any other computer or smartphone with this private key.

Is this behaviour correct? Because the above quote says, that I have to approve every new client, but in practice I havn't.

share|improve this question
It actually shouldn't matter where you create the keypair; what matters is where it's installed. It's just a keypair. You could generate it on my computer and copy it to your client machine for all ssh cares. – Blacklight Shining Feb 23 '13 at 19:07
If you disable password authentication, then you will need a copy of the private key to ssh into your server. What it means by “pre-approving” is adding the client's public key to the server's authorized_keys file. You could, however, copy the private key onto an encrypted flash drive or something and keep it with you in. In a pinch, you could move any machine's private key file aside and temporarily replace it with the one on the flash drive. Just remember to wipe your private key when you're done. ;) – Blacklight Shining Feb 23 '13 at 19:13
@BlacklightShining - That was my intention. I wanted to use the private key in combination with a portable Putty on an encrypted flash drive. – netblognet Feb 23 '13 at 22:09
In that case, you should probably keep that keypair separate from key pairs that are on actual computers. And, yes, the behavior of not needing to “pre-approve” the flash drive each time, even when using it to connect from different machines (including smartphones) is correct. – Blacklight Shining Feb 23 '13 at 22:32
up vote 4 down vote accepted

In general, a private/public key pair should be generated on the client you want to use and EACH client should have its own private/public key pair. The private key is for the client ONLY and the public key can be shared to the servers you want access to.

Normally the server should only store the public keys and each public key says "the client with the corresponding private key can access this machine."

You should not have more than one client with the same private key. If any one of those clients are compromised then ALL of your clients are compromised and you have to remove the private key and regenerate a new key your systems. This is why one private/public key pair per client is good because if any are compromised then the server just needs to revoke one public key from the authorized_keys file, to remove access using that private key. It seems kind of odd, but in practice you don't want to deny all connections if just one client is compromised. (To answer your sub-question the behaviour is correct but not what you should allow to occur.)

Finally since you own the server, it is "okay" to generate the key pair on your server and then transfer but in general when a person doesn't always own the server, they generate the key pair themselves and send the public key to servers they want to access and system administrators deal with various verification processes to make sure they are adding a client that they want to allow.

share|improve this answer
Thank you for your answer. This was very helpful to me. – netblognet Feb 23 '13 at 22:08

As stated in the Ubuntu community the method only increases your security if you disable password authentication so that it is only possible to connect via the private key.

If you disable password authentication, it will only be possible to connect from computers you have specifically approved. This massively improves your security, but makes it impossible for you to connect to your own computer from a friend's PC without pre-approving the PC, or from your own laptop when you accidentally delete your key.

To disable password authentication, look for the following line in your sshd_config file:

#PasswordAuthentication yes

replace it with a line that looks like this:

PasswordAuthentication no

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .