Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to create more than one private key to SSH into an EC2 instance? What's the general best practice for this? We have multiple users who need to SSH into the servers and distributing one key just does not work well. This does not allow us to remove users from being able to SSH into the server unless we change the key and redistribute.

share|improve this question
up vote 5 down vote accepted

Absolutely; you just place all the relevant public keys into the image and you should be right to go. I prefer to use a configuration management system to manage SSH keys; that way it's fairly trivial to revoke a user's access even on running systems. There are also far more... let's say "imaginative"... ways of handling this, such as storing all your SSH keys in LDAP, that centralise SSH keys like any other credential.

share|improve this answer
When you start wanting to store SSH keys in LDAP it's time to learn about Kerberos. – 84104 Aug 12 '11 at 2:52
I've deployed Kerberos; personally, I think it's a solution in search of a problem, and a rather finicky and annoying solution at that. – womble Aug 12 '11 at 3:06
@Ash: Questions go in questions, not comments. – womble Feb 8 '13 at 22:07
I was going to ignore the above comment - but for anyone new to the site I felt like I should make it clear that if you have a comment which is related to the implementation of the given answer, clarifications or misunderstandings, this should be made clear in the comments, so that the OP can make edits to the answer in order to clarify any confusion which may occur. – Ash Feb 9 '13 at 12:43
No, you should ask clarifying questions in comments if the answer doesn't address the question originally asked. If you want to ask a new question based on the content of an answer, you should use the big "Ask Question" button in the top right corner of the page to ask a new question. This is a Q&A site, not a discussion forum. – womble Feb 12 '13 at 8:33

You could also use standard ssh mechanisms. The best approach would be if user run on their machine ssh-keygen to generate his/her key pair. Then they send you ~/.ssh/ (or, depending on chosen algorithm) and you add its content to the .ssh/authorized_keys on the destination host in the home directory of the user account they should be able to access. There can be more than one key in the file. One per line. And that is all! The same public key ( can be used on any number of hosts - it will always identify the user.

You can also do it other way round - you run the ssh-keygen and post ~/.ssh/id_rsa (or id_dsa) to the user. And the user saves the file to ~/.ssh/id_rsa. Just need to remember to change permissions to 600 (-rw-------) of that file, otherwise ssh won't accept it. This is obviously less secure, since the private key is being distributed over email probably.

It can also be done in PuTTY with PuTTYgen.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.