Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to create an ssh key for another user. I'm logged in as root. Can I just edit the files generated by ssh-keygen and change root to the user I want?

share|improve this question
3  
If you generate the key for the user you also have to have a secure method of getting the private key and it's pass phrase to the user. Much better the user generate the key and then just email you the public key. –  Iain Oct 22 '11 at 20:02
    
But isn't that difficult is you don't allow password logins? If I am key-only, and I set up a new user, they can't login to set up their key. –  LVLAaron Aug 8 '13 at 14:20

3 Answers 3

up vote 24 down vote accepted

ssh keys should never be generated for another user. The private key is called private for a reason.

If you want to create a keypair for yourself you could do that with ssh-keygen.

ssh-keygen -f username creates 2files in the current directory. username.pub is the public key, which you could append to the users ~/.ssh/authorized_keys on your server.

The other file, just called username is the private key and therefore should be stored safely at the user. Default location would be ~/.ssh/id_rsa (here named id_rsa, which is default for rsa keys)

But technically you could store the key anywhere, but keep in mind the key is not allowed to be readable for anyone but the user.
With ssh -i path/to/privatekey you could specify that location, while connecting.

share|improve this answer
2  
+1 for expressing that it is a private(!) key –  mailq Oct 22 '11 at 19:49
17  
You are assuming that the user is a real person. If the login is an non-interactive user utilized to perform utility tasks (e.g. running running maine scripts on remote servers), then yes, you would probably generate the key for that user manually. Of course, that has its own security implications, but that's another story. –  Rilindo Oct 22 '11 at 22:31
1  
@Rilindo ssh -i to a private key for a non-privileged process is how I handle more than a few automated rsync backup processes. :) –  Shadur Oct 23 '11 at 9:56

There's no user information in the SSH keys.

Last field in a public key is a comment (and can be changed by ssh-keygen -C newcomment).

No need to do anything special to make a key for another user, just put it in the right location and set permissions.

share|improve this answer

Become the user by using su and run the key as that user:

[root@kvm0001 ~]# su - joeuser
[joeuser@kvm0001 ~]$ ssh-keygen -t dsa (or rsa1 or rsa, depending on your security requirements)
Generating public/private dsa key pair.
Enter file in which to save the key (/home/joeuser/.ssh/id_dsa):
share|improve this answer
    
Why specify the DSA? –  Ram Oct 23 '11 at 2:18
    
Whoops, force of habit. Let me update. –  Rilindo Oct 23 '11 at 2:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.