Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using Amazon EC2 server that by default uses a ssh key to authenticate. We want to give access to another user in the server but we don't want to give out our initial key, so we want to create a second key that we can remove later. Is there any way to accept more than one key?

This post is very helpful to set the first key.

share|improve this question

You can have multiple authorized keys configured for each user account. Simply create the public/private keypair the same way, except at the end run this command:

cat >> ~/.ssh/authorized_keys

Where is whatever filename the new key is created as. Now, if you look in the authorized_keys file you will see both public keys listed, one per line.

And just to be clear, this will allow both keys to be used to login to the same user account. If you simply want this person to have auditable access to the system, I would recommend creating a new user. Though still using the public key for access.

share|improve this answer
Hi Packs. I created a public/private key with puttygen, then I followed your instructions to add the public key to the authorized_keys on the user account. When I try to login using the newly created key I get "Server refused our key". Any ideas? – Geo Aug 7 '09 at 13:52
Geo, see Jonathan's answer below. You need to make sure you get the openssh-compatible key (instead of using the "save private key" button, just copy the key out of the frame at the top. – Chad Huneycutt Aug 7 '09 at 14:38

Using puttygen, generate a key. I use RSA, SSHv2 keys @ >2048 bits personally, but it's your choice.

Next find the function in puttygen which lets you export an OpenSSH public and private keypair. Take the public key and append it to the end of ~/.ssh/authorized_keys on the server, making sure you remove any keys you've appended previously that aren't in OpenSSH format (i.e. the Putty keys you mention in your previous comment).

Do this multiple times for the different keys you want to be able to sign into the server. Pagent on your local box holds the Private key, but it might want to read the .PPK file instead of the private key file you exported.

Please do note that, once either of the users has logged in, they can change the authorized_keys file and lock out the other user. In other words, this is not a security-focussed setup, and there's not much you can do to make it so. Your only options are to look at limiting the commands a user can run and not giving them a shell ("man authorized_keys" and search for the sections talking about "command=" and "no-pty"), or to ask the server's sysadmin to relocate where authorized_keys is located (the AuthorizedKeysFile setting in /etc/ssh/sshd_config).

Failing that, give both users a separate login and use the server's user/group file ownership ACLs to their full effect. That's probably best, to be honest ...

share|improve this answer
Thanks for the clarification with putty generated keys. Since I don't deal with Windows, I didn't realize they would be a different format. – Scott Pack Aug 7 '09 at 14:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.