I'm a little bit confused about setting up a password-less login for multiple machines to begin with, but I think I could do it from scratch. The problem is I already have it set up for one machine and I don't want that to be blown away when I try to set it up for the other machine. Let's clarify:

  • Machine A: the machine I'm connecting from
  • Machine B: the machine I'm connecting to. Password required
  • Machine C: the machine I'm connecting to. Password-less ssh

I have read some tutorials on setting up password-less ssh to a certain site, but they usually start with "move id_rsa out of the way so it doesn't get blown away," but then at the end of the tutorial it's not moved back. If I had no help at all, here is what I would do:

  1. Log into B
  2. ssh-keygen -t rsa -f ~/id_rsa.other
  3. scp id_rsa.other.pub A:~/.ssh
  4. echo "Host A \n Identity File ~/.ssh/id_rsa.other" > ~/.ssh/config

(Note that I realize these commands may not be exactly correct, but this is just the idea).

What I'm not quite clear on is if I need to update the config for A, B, or both. I'm fairly certain to do a password-less login from A to B, it is A that needs the public key .. but I also suppose I need B to use the correct id_rsa file for that public key. Finally, I don't want the password-less login for C to be affected at all .. it's using id_rsa. Am I going wrong anywhere?


It sounds like you're connecting A to B or A to C, right? (not A to B and then B to C)

If so, then you ust need to copy your id_rsa.pub to B and also to C.

The modification of the ~/.ssh/config file you have in step 4 in your sequence is needed if you don't use the standard ~/.ssh/authorized_keys file.

Here's what I would do (after generating the id_rsa and id_rsa.pub)...

  1. Copy id_rsa.pub (using scp, using password prompt) to B and to C
  2. Log into B - mv id_rsa.pub ~/.ssh/authorized_keys
  3. Log into C - mv id_rsa.pub ~/.ssh/authorized_keys

The private key is kept on A. You can use the same private key/public key combination to connect to more than one machine.

If, for some reason, you have multiple public keys for the user on B or C, you can append them to the end of the authorized_keys file.

  • Yes you're exactly right .. I think this is what I need to do, but C is already set up properly (it already has the public key it needs I think .. can't check for sure since it doesn't allow shell access, but I can scp to it at least). So I guess I really only need to do steps 1 and 2. I'll accept if this works. – Explosion Pills Mar 26 '12 at 17:14
  • Here's the thing: the id_rsa.pub on A has a pass phrase that I don't want for B .. so I guess I can just generate another id_rsa.pub and just concatenate it. Does ssh-keygen let you do that automatically, or do I have to create a new key file and concatenate manually? – Explosion Pills Mar 26 '12 at 18:39
  • The .pub is a public key file. The public key is meant to be spread around. It's really the private key on A that is protected by the pass phrase. You type in your pass phrase to verify that you are authorized to use the local private key. When A is negotiating the connection to B or C, it doesn't pass the pass phrase and, I assume, doesn't pass the private key but only receives the public key. Try running ssh -v B or ssh -vv B to see more information about the authentication negotiation. – Doug Harris Mar 26 '12 at 19:01
  • More discussion of the pros and cons of multiple public keys in this question – Doug Harris Mar 26 '12 at 19:03
  • Just a little hint from me because this got edited three minutes ago: instead of scp the pubkey you can just run ssh-copy-id B and the standard pubkey will be sent to B. If you need you can add the parameter -i <pubkey-file> if you have multiple keys. – noggerl Oct 16 '13 at 21:23

I have finally crafted a convenient way to setup password less ssh to multiple nodes. Have been using those scripts for a while and it has been flawless for me so far. Hoping that it will help someone save time. I believe that this mechanism can run under a few minuted for a few hundred nodes at once. It is based on expect & bash scripts. Take a look at it and let me know your feedback. Link to scripts - http://adhocshare.tk/linux/setting-password-less-ssh-across-nodes-cluster/

If you've used ssh-keygen & ssh-copy-id before, the whole idea in the scripts is to automate that task on all nodes at once using pdsh and a file containing hostnames. Almost everything is automated and will save you a ton of time. Let me know how that works for you. I will be more than glad to help you.

  • 2
    You should post the code from there into this answer. That way if the website ever is no longer reachable, people will still be able to use the script. – hichris123 Nov 12 '16 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.