Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm wondering what are the steps to configure password-less ssh keys so I can connect and pull data from multiple remote servers. Can I just do:

Backup Machine:

ssh-keygen -t rsa
ssh-copy-id -i /home/user/.ssh/ root@server1
ssh-copy-id -i /home/user/.ssh/ root@server2
ssh-copy-id -i /home/user/.ssh/ root@server3

and on each remote server{1-3} do:

PermitRootLogin forced-commands-only

and let rsync pull the data from the backup server to each remote.

Would those be the correct steps?


share|improve this question
Are you rolling your own backup solution or using something like dirvish? – Andrew Jun 15 '11 at 7:47
  1. Run the generate command as root (via sudo -s or sudo -i) so the key isn't in your home directory
  2. You can't ssh/scp to your servers as root if you don't have interactive root login (e.g. on Debian-based systems); do it as your user, assuming you have a login on those machines. Then login and copy the authorized_keys file into /root/.ssh/ on each server and set the correct permissions.
  3. Use a from="w.x.y.z" stanza in your authorized_keys file if you have a static IP on your backup machine. The PermitRootLogin forced-commands-only isn't really much better than without-password.
share|improve this answer
thanks for the tips, though, not sure what do you mean with interactive login? All machines are running Debian. – JoshyD Jun 15 '11 at 4:49
@JoshyD you're trying to scp the public key to your remote machine as root, which will ask for a password (interactive login), which doesn't exist. I'll clarify my answer to suggest copying it as your own user. – Andrew Jun 15 '11 at 7:39

Yes, you can do this. I wrote a blog post on this a while back (it's based around setting up dirvish, which is an rsync based backup system). Once you setup the keys on the clients you can run a backup, see what command it runs, and then set forced-commands.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.