Can a ssh key work for restricted to home user

Question

I am currently running linuxmint and openssh. I have 2 accounts on my computer Joe and Bob. I have the keys and passphrase created by joe stored in the /home/joe/.ssh/ folder. I can connect to Joe using ssh/sftp. but I can not connect to Bob. My question is do I have to create a new set of keys for Bob in order to connect to him even though both accounts are on the same machine? Also I have tried to chroot jail for sftp users (Subsystem sftp internal-sftp) I get locked out of BOTH accounts when trying to use it. It worked when I was using a password instead of a key passphrase.

Thank you

Answer 1

I can connect to Joe using ssh/sftp. but I can not connect to Bob.

How I see it: Joe has the public key and it in an authorized_keys file and Bob doesn't

My question is do I have to create a new set of keys for Bob in order to connect to him even though both accounts are on the same machine?

You can copy the public key into Bob's authorized_keys file. Try ssh-copy-id bob or edit the /home/joe/.ssh/authorized_keys on Bob.

Permissions on HOME directories must deny group and "others" write for SSH keys to work since the .ssh directory could be renamed and re-created as directory write permission controls that.

Also I have tried to chroot jail for sftp users (Subsystem sftp internal-sftp) I get locked out of BOTH accounts when trying to use it. It worked when I was using a password instead of a key passphrase.

You sound to me like you want to use scponly which is in APT, try apt-get install scponly.

Answer 2

In order to log in to a user account on a remote machine using SSH, you need the public key for the account to be in the ~/.ssh directory for the account, and you need the private key that matches the public key to be in the ~/.ssh directory on the local machine from which you are attempting to connect.

You can use the -i option to ssh to explicitly specify another file other than the default private key file in ~/.ssh.

You can use the same private and public key pairs for any number of users. However, the keys must match, that is the must have been created as a pair. If you lose a private key, it is not possible to recover the public key. If you loose the public key you can regenerate it from the private key using an openssl command.

You can put public keys for additional users who you wish to allow to log into an account in ~/.ssh/authorized_keys.

Other than having the private key file in ~/.ssh on the remote machine, the most common error that prevents you from logging in is file permissions. Make sure that your ~/.ssh directory permission is no more than 700 and that the file permissions on any private keys, id_dsa or id_rsa are no more than 400.