how to add a (given) private key in ssh whose public key is already setup on server

Question

I KNOW how to setup a new ssh key pair with github.

If someone gave me a private key and told me to connect to a server via ssh on a mac, how do I set this up?

NOTE: I can't change the server settings.

Answer 1

I assume the standard OpenSSH is available on your Mac; if you're using a pretty GUI program, then this might not work. I also assume you've been given an OpenSSH-standard key. (The commercial ssh.com keys might be formatted differently; at least they were a decade ago, when I last used a provider that still used the commercial SSH.)

Perhaps you already have a private key; check ls -l ~/.ssh/id_* to see if you already have a private key installed. If you do (and you want to keep that key) then you'll have more work to do.

If you don't already have a private key, take a look at the first line of the file. It'll look something like this:

-----BEGIN RSA PRIVATE KEY-----

If it says RSA, like mine, then store the file into ~/.ssh/id_rsa. If it says DSA, store it into ~/.ssh/id_dsa.

If the ~/.ssh directory does not exist yet, create it:

mkdir ~/.ssh
chmod 700 ~/.ssh

The chmod 700 is important -- ssh is picky about permissions: if even group write is available, you may have problems.

I don't know the easiest way to store the file. If you have a standalone file (email attachment, web site download, etc.), you can simply move the file into place:

mv Path/to/the/file ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa

The chmod 600 is important -- ssh is picky about permissions: if even group read is available, you may have problems. I'm not kidding -- I've spent too much of my life debugging connection problems that came down to over-strict permissions checking by ssh. You could make it 400 and prevent yourself from mistakenly overwriting it, but mine is 600 with no ill consequences.

If you've got the file copy-and-pasted into an email text or web page text, you'll need to use a text editor of some sort to save the file, via copy-and-paste of the text itself. (Don't use Word. BBEdit or TextMate or .. whatever Apple calls their plain text editor .. would work.)

Now test it:

ssh hostname

e.g.:

$ ssh haig
Enter passphrase for key '/home/sarnold/.ssh/id_rsa': 

If you need to give a username too:

ssh username@hostname

The important piece is the for key -- if it just asks for a password, it is probably a password for the remote endpoint, and that won't work. If it asks for the passphrase for the key, then you're running.

---

If you already have a private key you wish to keep using, store the file into something else; e.g. ~/.ssh/id_rsa_for_mithra, and then add a new Host entry into a ~/.ssh/config configuration file:

host mithra
    IdentityFile ~/.ssh/id_rsa_for_mithra

Here, I've assumed the hostname is mithra. Use whatever name or IP address you've been given.

---

The ~/.ssh/config file can also be used to specify a per-host username if you want to avoid giving it on the command line all the time.

And the final note: most ssh users use the ssh-agent to store a decrypted version of their private key rather than re-type the passphrase to unlock it all the time. I understand an ssh agent is integrated into OS X these days -- it would be worth investigating how to use it. Perhaps it is as simple as running ssh-add first. (I like ssh-add -t 3600, so the key works for an hour before the decrypted version is thrown away. That helps protect the key material somewhat if I walk away from my workstation without requiring my to run ssh-add -D when I leave.)

Answer 2

I found your question while looking for a way to manage Amazon EC2 keys. Like you, I already had a key for github.

---

What I did was duplicate the existing id_rsa file.

cp ~/.ssh/id_rsa ~/.ssh/id_rsa_amazonhost.pem

And then replace the contents of this new file (id_rsa_amazonhost.pem) via cut/paste with the private key provided by Amazon.

Then I added an entry to ~/.ssh/config (replace my-hostname and my-username as appropriate).

Host my-hostname.example.com
    IdentityFile  ~/.ssh/id_rsa_amazonhost.pem
    User my-username    

This allowed me to ssh my-hostname as desired.

---

For a one-time connection, you can skip the ~/.ssh/config file and simply run

ssh -i id_rsa_amazonhost.pem my-username@my-hostname