3

I am new to this SSH thing and I know my machine has already generated ssh key pairs in the past to connect to a server. If I want to connect to different server in different network, do I need to generate separate key pair and save them in separate folders? How can I do that? How can I select which key I use when I am connecting to the server?

I am using Ubuntu 18.04

Thanks!

2 Answers 2

3

You can use the same key pair for two servers. You just copy over the public portion of your keyset to both machines and add it to the authorized_keys file.

scp .ssh/id_rsa.pub remote.server.com:
ssh remote.server.com cat id_rsa.pub >> .ssh/authorized_keys

Afterwards you can delete id_rsa.pub from the remote server

It is also worth noting that you can specify the private key on the command line when running ssh with the -i switch: ssh -i .ssh/keyForServer1.rsa remote.host.com

If you don't have a id_rsa.pub in your .ssh directory, then you can generate a new key pair:

cd ~/.ssh
ssh-keygen -t rsa

This will create your private key, id_rsa which you should never copy anywhere as it is equivalent to your password, and id_rsa.pub which you copy to remote servers. I recommend skimming through the manpage for ssh-keygen as it has some useful options


Note: Some systems, notably systems running older versions of OpensSSH, use .ssh/authorized_keys2 instead

3
  • Hi @Jarmund, thanks! What I don't understand here is that inside my .ssh folder, I have 3 files, which are authorized_keys, known_hosts, and known_hosts.old. I don't see any id_rsa or id_rsa.pub. Inside my authorized_keys, I have "ssh-rsa [XX] [admin_account]" where I suppose [XX] is the key.
    – eng2019
    Feb 12, 2020 at 2:42
  • @eng2019 known_hosts is a way for your computer to to keep tabs on the identity of other machines. It has one line for each machine you've ever shelled into. authorized_keys contains a list of public keys whos matching private key is allowed to log in as your user on your machine. as for id_rsa.pub, you most likely need to generate it (or put it there, if you've already generated it and placed it elsewhere). I've added details about generating the key-pair in my answer.
    – Jarmund
    Feb 12, 2020 at 4:31
  • You need to quote ssh [user@]remote 'cat pubkey >>.ssh/authorized_keys' so it happens on the remote machine not locally. Or most systems have ssh-copy-id which manages this for you. Feb 12, 2020 at 9:23
0

SSH server uses Public - Private key pair as an authentication mechanism. The client generates a key pair, the private key remains with the client, and the public key needs to be placed within the Authorized_keys file in the server machine, generally within the .ssh folder placed within the home profile of the user on the server machine.

When you connect via SSH, you take on the security profile of the user you have logged in as, the same user in whose home folder (.ssh -> Authorized_keys) you placed the public key.

On the client side, that is, your own machine, you will have known_hosts file, which keeps a tab on ssh servers which you have previously connected to.

When you connect to a SSH server for the first time, you are generally prompted with a message asking if you trust the server to which you are attempting a connection, if yes, the server's details are added to the known_hosts file.

In your question, you have indicated that your machine, intended to be used as a client, has already generated a key pair. You can take the public key of that key pair, and place it in the Authorized_keys file, in any number of servers. Just ensure that, on the server side, in the sshd_config file, the server is enabled to use Key pair authentication. On your machine, if using a GUI SSH client, you can select authentication mechanism as key pair, and browse and select the private key, or if using command line, then

ssh -i .ssh/<your_private_key> sshserver.com

2
  • Public key goes into authorized_keys, not private.
    – Jarmund
    Feb 12, 2020 at 7:18
  • Oops, bit of a typo. Thanks. Feb 12, 2020 at 7:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.