1

We are using Amazon EC2 server that by default uses a ssh key to authenticate. We want to give access to another user in the server but we don't want to give out our initial key, so we want to create a second key that we can remove later. Is there any way to accept more than one key?

This post is very helpful to set the first key.

2 Answers 2

7

You can have multiple authorized keys configured for each user account. Simply create the public/private keypair the same way, except at the end run this command:

cat id_rsa.pub >> ~/.ssh/authorized_keys

Where id_rsa.pub is whatever filename the new key is created as. Now, if you look in the authorized_keys file you will see both public keys listed, one per line.

And just to be clear, this will allow both keys to be used to login to the same user account. If you simply want this person to have auditable access to the system, I would recommend creating a new user. Though still using the public key for access.

2
  • Hi Packs. I created a public/private key with puttygen, then I followed your instructions to add the public key to the authorized_keys on the user account. When I try to login using the newly created key I get "Server refused our key". Any ideas?
    – Geo
    Aug 7, 2009 at 13:52
  • 1
    Geo, see Jonathan's answer below. You need to make sure you get the openssh-compatible key (instead of using the "save private key" button, just copy the key out of the frame at the top. Aug 7, 2009 at 14:38
2

Using puttygen, generate a key. I use RSA, SSHv2 keys @ >2048 bits personally, but it's your choice.

Next find the function in puttygen which lets you export an OpenSSH public and private keypair. Take the public key and append it to the end of ~/.ssh/authorized_keys on the server, making sure you remove any keys you've appended previously that aren't in OpenSSH format (i.e. the Putty keys you mention in your previous comment).

Do this multiple times for the different keys you want to be able to sign into the server. Pagent on your local box holds the Private key, but it might want to read the .PPK file instead of the private key file you exported.

Please do note that, once either of the users has logged in, they can change the authorized_keys file and lock out the other user. In other words, this is not a security-focussed setup, and there's not much you can do to make it so. Your only options are to look at limiting the commands a user can run and not giving them a shell ("man authorized_keys" and search for the sections talking about "command=" and "no-pty"), or to ask the server's sysadmin to relocate where authorized_keys is located (the AuthorizedKeysFile setting in /etc/ssh/sshd_config).

Failing that, give both users a separate login and use the server's user/group file ownership ACLs to their full effect. That's probably best, to be honest ...

1
  • Thanks for the clarification with putty generated keys. Since I don't deal with Windows, I didn't realize they would be a different format.
    – Scott Pack
    Aug 7, 2009 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .