64

I have accounts on two machines: H1 and H2. I created ssh keys on H1 and installed it on S1. I can now ssh to S1 from H1. I want to do the same from H2. How do I install the ssh keys generated on H1 on H2?

1
  • 3
    Since ssh-copy-id is a more fool-proof (no overwrite of existing keys or accidentally copying the private key instead of the public key) and less known solution, please consider to accept one of those answers as the accepted answer. – agtoever Aug 21 '14 at 16:12
40

Edited: If you own both machines, you may share your private key. But this solution is not safe for case of stolen notebook or for machines you don't own.

You may copy your private keys from H1 to H2, if you want to use the same private key to be able to login from H2 to S1. When you at H1 do the commands:

H1$ ssh H2 mkdir ~/.ssh
H1$ scp  ~/.ssh/id_rsa ~/.ssh/id_dsa H2:~/.ssh/

Warning! This will delete and replace any private key you had at H2.

Better way is to generate new private keys on H2 (ssh-keygen) and install their public part on S1 with ssh-copy-id util. In this safer case you will have two sets of keys; one is for H1-S1 login and second for H2-S1 login. There will be two public keys authorized at S1. And you will be able to revoke any of them or both (for example, when you notebook is stolen, or owner of the machine decides to disable you account and reuse all your files).

4
  • 11
    Copying a private key is really not a good idea. Having a single key at multiple locations 1. makes it more vulnerable, 2. increases risk that you lost control of all the locations, 3. does not allow you to disable access from just one location. From the security point of view you should generate a new key-pair on every location - the solution from Mu Qiao. – pabouk Sep 4 '13 at 16:56
  • I recognise this is 9 years old, and was possibly relevant back then. I would argue H1 = H2 is secure! If you are smart enough to change it when your gear gets stolen then you get a huge benefit of knowing where you have used it. It is the same argument, should I use a password manager with a master pass to all passwords. If the machine is stolen then you are compromised anyway, its only double your chance of being stolen. But the security around the keys is many times better than double, the the benefit of only tracking 1. This is old school, like change your pw every 3 months. – NZ Dev Feb 17 '20 at 3:50
  • scenario - you have different H1 & H2 and Your Laptop gets stolen. Which public key do you remove from S1, and S2, and S3... ? because most of the public keys look the same, so now you have to remove most all and everyone (incl you)has to re-auth. – NZ Dev Feb 17 '20 at 4:05
  • @NZDev, what if the machine is not stolen physically but infected by malware, or your cloud based vps was hacked and your keys are copied to hacker? You will not know about this at the same moment. To find which key to delete public keys usually have username and hostname added in last field (comment) - man7.org/linux/man-pages/man8/… (identify the key). Multifactor auth is safer (master password is ok, hardware key + pin is better), but sometimes keys are authorized to allow using of some automatic scripts. Old school methods not always work best. – osgx Feb 18 '20 at 17:17
31

Use ssh-copy-id

SYNOPSIS

ssh-copy-id [-i [identity_file]] [user@]machine

DESCRIPTION

ssh-copy-id is a script that uses ssh to log into a remote machine and append the indicated identity file to that machine's ~/.ssh/authorized_keys file.

2
  • 1
    @I want to do ssh from H2 to S1. I want to transfer and install my private and public key from H1 to H2. Will this do that? – Bruce Sep 6 '11 at 15:17
  • 3
    @Bruce no, you need to regenerate the keys on h2 and use that command to copy your keys. Another approach is letting h1 and h2 share home directory. – Mu Qiao Sep 6 '11 at 15:19
16

Use two private keys

Set up H2 using the same process (but not the same private key) as you did when you set up H1:

  • There is never a good reason to copy a private key from some other machine. If you haven't already generated a fresh private key on H2, do so now. Also generate the corresponding public key. In a terminal on H2,

type: ssh-keygen -t rsa

  • Copy your H2's public key to the server. In a terminal on H2,

type: ssh-copy-id username@S1.net

(but use your actual username on S1 and S1's hostname, and later type in your password on S1 when it asks for it).

This installs the public key of your workstation into the ~/.ssh/authorized_keys file for that user on the server.

  • There is no step 3. From now on, you can log into the S1 from your H2, and also log into the S1 from your H1.

details

I assume that what you are really asking is

  • I have a server ("S1")
  • I log in to my server from my personal laptop ("H1")
  • I also want to log in to my server from my workstation ("H2").

What is the right way to do that?

  • I suppose I could simply log in with the same password from both places. That can't be the right way, because everyone says that public key authentication is much better than passwords. (a)
  • I suppose I could simply copy the private key from my laptop to my workstation. That can't be the right way, because everyone says that the private key is never supposed to leave the client machine.

People have it hammered into their head that one account on a server has a single username and, of course, a single authorized password.

Public-key systems like ssh are better than the password system: One account on a server has a single username and any number of authorized public keys, all of them listed in the ~/.ssh/authorized_keys file.

(more details).

4
  • 1
    Forgive me for repeating myself. – David Cary Aug 21 '14 at 16:09
  • As a best practice, should we be pruning ~/.ssh/authorized_keys as old workstations are retired? – BigRon Feb 5 '20 at 16:10
  • This is the problem with this approach you now need to prune these old public keys out. – NZ Dev Feb 17 '20 at 3:44
  • This actually works and is the easiest and more secure way. Thanks! +1 – Norman Bird Nov 21 '20 at 19:16
4

For shifting of SSH keys from one computer to another. Just copy the entire folder from ~/.ssh from H1 (old machine) to ~/.ssh content folder of new machine H2.

Now try:

ssh ubuntu@13.123.43.26 (your S1 ip)

Most probably you will get a permission warning to fix that run:

chmod 400 ~/.ssh/id_rsa

Now again:

ssh ubuntu@13.123.43.26 (your S1 ip)

It will work fine now.

1
  • copying the keys(he said installing) was what he was asking for, not how to set permissions or login. scp /home/user1/.ssh/id_rsa user2@mydomain:~/.ssh/id_rsa – NZ Dev Feb 17 '20 at 4:08
3

All the questions here address the issue of copying identity from one server to another server by making use of ssh-copy-id, which is not the point of the question.

The problem that the questions seem to ask is how to make use of the same private-public key pair generated and used on a personal computer (H1) can be used on another personal machine (H2) so as not to have to set up a new private-public key and manually add it to each server that we used to connect to.

This is not advisable for security reasons as extensively mentioned by others, however, it is possible to achieve with per the following steps:

  1. Copy your private (e.g. ~/.ssh/id_rsa) and public (e.g. ~/.ssh/id_rsa.pub) from your H1 machine to your H2 machine in location ~/.ssh (Do this only through a trusted USB that you will format afterwards, do not use emails or any other internet-based medium). When you will execute the following command in H2 ls -alt ~/.ssh the output will contain at least the following:
-rw-r--r--  1 youUserName youUserName 1240 Nov  3 14:52 id_rsa
-rw-r--r--  1 youUserName youUserName  412 Nov  3 14:52 id_rsa.pub
  1. On H2, change the permission of the private key to be less accessible (otherwise next step will follow) with the command chmod 600 ~/.ssh/id_rsa, so that the output of the following command ls -alt ~/.ssh will contain the following (notice the difference from the above permission):
-rw-------  1 youUserName youUserName 1240 Nov  3 14:52 id_rsa
-rw-r--r--  1 youUserName youUserName  412 Nov  3 14:52 id_rsa.pub
  1. Final Step. on H2, now use the command ssh-add ~/.ssh/id_rsa to enable the private-public key pair to be used to identify yourself from H2 to any server that you will connect to by using the private-public key that you imported.

Now, any ssh or scp command such as ssh yourUserName@ip-address should succeed as if you were logged into H1.

Security Considerations:

  • PLEASE CONSIDER OTHERS SUGGESTIONS FOR BETTER SECURITY, AKA GENERATE A NEW PRIVATE-PUBLIC KEY PAIR
  • The only case in which I see this to be useful is when moving on to a new machine for good so that H2 will become your primary computer and H1 will not be used anymore;
  • If you are using both H1 and H2 still, there is no plausible good reason to use the same private-public key pair from H2.
0

Would ssh-copy-id do the job for you: http://linux.die.net/man/1/ssh-copy-id?

3
  • @I want to do ssh from H2 to S1. I want to transfer and install my private and public key from H1 to H2. Will this do that? – Bruce Sep 6 '11 at 15:16
  • 2
    If you are logged in to either S1 or H1 (which now have your key) using ssh-copy-id will allow you to transfer your public key (not private) to the H2. In general it is best to limit the number of machines on which your private key is installed. Try to keep it to a few secure machines only to prevent its loss. – Alex Sep 6 '11 at 15:21
  • How do I copy my private key to H2? – Bruce Sep 6 '11 at 15:25
0

Transfer the keys using scp like this:

scp /home/[user]/.ssh/id_rsa* user@ip:/home/[user]/.ssh/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.