1

I am trying to SSH from one Digital Ocean droplet to a second droplet.

Here is my setup:

Setup and Configuration

  • Droplet 1: MyTest (Ubuntu 16.04 512 MB RAM)
  • Droplet 2: RemoteHost (Ubuntu 16.04 512 MB RAM)
  • Local system (Windows 7 with Putty, PuttyGen)

Based on the instructions in the video here, I used PuttyGen to generate a public-private key pair on my Local system (Windows 7). I did not save the public key. I saved the Private key on my Local system (Windows 7). I added the public key to the MyTest droplet. I can now use Putty to ssh from my Local system (Windows 7) into MyTest without a password exactly as the video shows.

Problem

Now, I would like to SSH from the MyTest droplet into the RemoteHost droplet.

Step 1.

I created the RemoteHost droplet and I attached the same public key as for MyTest. So, both droplets MyTest and RemoteHost have the same public key.

Step 2.

From my Local machine (Winsows 7), I used PuTTy to SSH into the MyTest droplet.

Step 3.

Then, (from the MyTest droplet command line) I tried to SSH into the RemoteHost droplet with the following:

root@MyTest:~# ssh root@123.456.789.10

After this, I get the following error message

root@MyTest:~# ssh root@xxx
The authenticity of host 'xxx (xxx)' can't be established.
ECDSA key fingerprint is SHA256:yyy.
Are you sure you want to continue connecting (yes/no)?

enter image description here I also show the error in the above screenshot.

Question:

Is it possible to SSH from one Digital Ocean droplet into a different Digital Ocean droplet?

3

Yes, but you need to put a copy of your private key on MyTest. The SSH client on MyTest cannot read your private key on your PC.

This said, you should really use a different key pair to connect from MyTest to RemoteHost because the private key you put on MyTest can be copied by anyone who has access to that system (people with whom you share the server, perhaps DO staff...) and used to access other systems you access with that key. So, on MyTest, generate a second key pair and copy its public key to RemoteHost (which will have two public keys, the one from your PC pair and the one from the MyTest pair). Then you can connect to RemoteHost directly from your PC (using your local private key), or from MyTest (using the MyTest private key).

1
  • Thanks! I tried this but I get the following output: root@MyTest:~# ssh-keygen -t rsa -N '' -f myexample.rsa and then ssh-copy-id root@123.456.789.10. But it gave me the error: /usr/bin/ssh-copy-id: ERROR: failed to open ID file '/root/.pub': No such file (to install the contents of '/root/.pub' anyway, look at the -f option). Is there a missing argument in the ssh-copy-id command?
    – edesz
    Oct 12 '17 at 16:56
0

The answer by @xenoid worked! I chose to use a different public-private key pair to connect MyTest to RemoteHost.

Here is what I had to do (manual approach using these sources - here and step 4 from here) to follow @xenoid's suggestion:

On the 1st droplet (MyTest)

1.

root@MyTest:~# ssh-keygen -t rsa -N '' -f keyfilename.rsa
root@MyTest:~# cat ~/keyfilename.rsa.pub

The first line generates a keypair without password. The second line displays the contents of the PUBLIC key file.

2. Select all characters in the PUBLIC key file (using mouse cursor) and press Ctrl+C to copy the PUBLIC key.

3.

root@MyTest:~# exit

On the 2nd droplet (RemoteHost)

1.

root@RemoteHost:~# chmod 700 ~/.ssh
root@RemoteHost:~# chmod 600 ~/.ssh/authorized_keys
root@RemoteHost:~# nano ~/.ssh/authorized_keys

This file already contains the PUBLIC key of the public-private pair generated from my Local machine and added to the droplet when it was created.

2. Use the nano editor to paste the PUBLIC key. Press Enter to start a new line in this file

3. Press Ctrl+V to paste the PRIVATE key

4. Press Ctrl + X, y, Enter to save and exit with the same file name

5.

root@RemoteHost:~# exit

On Ubuntu client (AnsibleFlex)

1.

root@MyTest:~# ssh root@123.456.789.10 -i ~/keyfilename.rsa

where 123.456.789.10 is the public IP address of the RemoteHost. This opens the SSH prompt in the /root directory on RemoteHost, as required.

Thanks @xenoid!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.