Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to create more than one private key to SSH into an EC2 instance? What's the general best practice for this? We have multiple users who need to SSH into the servers and distributing one key just does not work well. This does not allow us to remove users from being able to SSH into the server unless we change the key and redistribute.

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Absolutely; you just place all the relevant public keys into the image and you should be right to go. I prefer to use a configuration management system to manage SSH keys; that way it's fairly trivial to revoke a user's access even on running systems. There are also far more... let's say "imaginative"... ways of handling this, such as storing all your SSH keys in LDAP, that centralise SSH keys like any other credential.

share|improve this answer
    
When you start wanting to store SSH keys in LDAP it's time to learn about Kerberos. –  84104 Aug 12 '11 at 2:52
    
I've deployed Kerberos; personally, I think it's a solution in search of a problem, and a rather finicky and annoying solution at that. –  womble Aug 12 '11 at 3:06
    
Single Sign On? Now I'm curious about somethings. Time to experiment, and then maybe ask a question or two. –  84104 Aug 12 '11 at 3:53
    
how do you place the keys into the image? I can't figure out what this means. –  Ash Feb 7 '13 at 17:20
    
@Ash: Questions go in questions, not comments. –  womble Feb 8 '13 at 22:07

You could also use standard ssh mechanisms. The best approach would be if user run on their machine ssh-keygen to generate his/her key pair. Then they send you ~/.ssh/id_rsa.pub (or id_dsa.pub, depending on chosen algorithm) and you add its content to the .ssh/authorized_keys on the destination host in the home directory of the user account they should be able to access. There can be more than one key in the file. One per line. And that is all! The same public key (id_rsa.pub) can be used on any number of hosts - it will always identify the user.

You can also do it other way round - you run the ssh-keygen and post ~/.ssh/id_rsa (or id_dsa) to the user. And the user saves the file to ~/.ssh/id_rsa. Just need to remember to change permissions to 600 (-rw-------) of that file, otherwise ssh won't accept it. This is obviously less secure, since the private key is being distributed over email probably.

It can also be done in PuTTY with PuTTYgen.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.