Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to create an ssh key for another user. I'm logged in as root. Can I just edit the files generated by ssh-keygen and change root to the user I want?

share|improve this question
4  
If you generate the key for the user you also have to have a secure method of getting the private key and it's pass phrase to the user. Much better the user generate the key and then just email you the public key. – Iain Oct 22 '11 at 20:02
    
But isn't that difficult is you don't allow password logins? If I am key-only, and I set up a new user, they can't login to set up their key. – LVLAaron Aug 8 '13 at 14:20
up vote 40 down vote accepted

ssh keys should never be generated for another user. The private key is called private for a reason.

If you want to create a keypair for yourself you could do that with ssh-keygen.

ssh-keygen -f username creates 2files in the current directory. username.pub is the public key, which you could append to the users ~/.ssh/authorized_keys on your server.

The other file, just called username is the private key and therefore should be stored safely at the user. Default location would be ~/.ssh/id_rsa (here named id_rsa, which is default for rsa keys)

But technically you could store the key anywhere, but keep in mind the key is not allowed to be readable for anyone but the user.
With ssh -i path/to/privatekey you could specify that location, while connecting.

share|improve this answer
2  
+1 for expressing that it is a private(!) key – mailq Oct 22 '11 at 19:49
23  
You are assuming that the user is a real person. If the login is an non-interactive user utilized to perform utility tasks (e.g. running running maine scripts on remote servers), then yes, you would probably generate the key for that user manually. Of course, that has its own security implications, but that's another story. – Rilindo Oct 22 '11 at 22:31
1  
@Rilindo ssh -i to a private key for a non-privileged process is how I handle more than a few automated rsync backup processes. :) – Shadur Oct 23 '11 at 9:56
    
I don't like that kind of answer that say "you shouldn't do that" but don't answer the question. While this may be correct and helpful for the context of the original question, other people may have the same question in a different situation. "ssh keys should never be generated for another user": That is true in the simple case. But consider multiple identities of the same physical person, for example. There may be multiple accounts on multiple systems, not all of them allowing you to generate keys or allowing to protect private keys appropiately. – Gustave Sep 9 '15 at 8:17
    
users or user's – User Nov 3 '15 at 1:00

There's no user information in the SSH keys.

Last field in a public key is a comment (and can be changed by ssh-keygen -C newcomment).

No need to do anything special to make a key for another user, just put it in the right location and set permissions.

share|improve this answer

Become the user by using su and run the key as that user:

[root@kvm0001 ~]# su - joeuser
[joeuser@kvm0001 ~]$ ssh-keygen -t dsa (or rsa1 or rsa, depending on your security requirements)
Generating public/private dsa key pair.
Enter file in which to save the key (/home/joeuser/.ssh/id_dsa):
share|improve this answer
    
Why specify the DSA? – Ram Oct 23 '11 at 2:18
    
Whoops, force of habit. Let me update. – Rilindo Oct 23 '11 at 2:51
1  
you should be using rsa (or possiblly one of the eliptic curve variants). dsa is limited to insecure keysizes. rsa1 is a legacy format for ssh1 which noone should be using anymore. – Peter Green Dec 19 '15 at 5:51

As seen here, you can use chmod to change the read permissions of the folder of the user you want to add the SSH key to.

vim /home/username/.ssh/authorized_keys

Then, simply paste the key to a new line at the bottom of that file

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.