1

Setting up passwordless ssh for multiple users has proved to be kind of a pain.

Currently I'm the single user of this Ubuntu 10.04 LTS VPS. I was able to establish a single RSA passkey under my home/user/.ssh/authorized_keys location. Fine. PuTTy works as expected, and Filezilla (sftp) links up as required.

I've been working on a single site that this user owns, and thats not been a problem. Now, I want to set up some other sites, and I've chosen Webmin with the VirtualMin plugin to make this work.

I made another user (or, rather, virtualmin did), but I've been unable to get FileZilla to link up to this new user. Could anyone with experience here explain what the setup is supposed to look like?

For example, can I use a single RSA key pair for all accounts (if, for example, I give ownership of files to the original user?). Or is it standard practice to create a separate key pair for each user and establish a separate PuTTY/filezilla login for each?

The error "Sever rejected the provided key" sucks after the fifth hour. I'm about to set up an ftp server and call it a day. What should I do to get multiple users to be able to connect to the site using RSA keys?

1 Answer 1

4

setting up passwordless ssh for multiple users has proved to be kind of a pain.

Only the first time - hopefully through the process you'll learn more about how all the pieces fit together, making it much easier in the future.

can I use a single rsa key pair for all accounts

If you are going to be the only one accessing the accounts, then yes, this is fine.

However, if others will need access to the account(s), they will need their own keypair.

Or is it standard practice to create a separate key pair for each user, and establish a separate putty/filezilla login for each?

Yes! :)

Each person needs to create their own keypair, then provide you with only the public key. The private keys are well, private, and they need to stay with the user that created them. As mentioned above, if you're the only person accessing the accounts, then you can use a single keypair.

Copy each user's public key into their ~/.ssh/authorized_keys file, and then ensure that the ownership and permissions of the .ssh directory and authorized_keys file is correct:

$ chown -R <username> /home/<username>/.ssh
$ chmod 700 /home/<username>/.ssh
$ chmod 600 /home/<username>/.ssh/authorized_keys

Keep in mind that each public key can should be on a single line in the authorized_keys file.

If the above doesn't work, you'll need to do some more digging to see what is going on. If this is the case, edit your answer and post any errors that are showing up in your /var/log/auth.log file upon unsuccessful connection attempts.

I'm about to set up an ftp server and call it a day.

Nooooooo! Remember, FTP Must Die!

7
  • 1
    There's nothing wrong with using the same RSA key pair for every account if the same human being has access to them. And there's nothing wrong with using multiple RSA key pairs for an account if more than one person has access to them. RSA key pairs should be owned by agents, such as users. And an RSA key pair allowing access to an account gives that agent access to that account. Apr 14, 2012 at 3:12
  • @DavidSchwartz - Yes, those are all true.
    – EEAA
    Apr 14, 2012 at 3:16
  • ...edited accordingly.
    – EEAA
    Apr 14, 2012 at 3:37
  • thanks for the reply! i may not have time to work on this until tomorrow, but i need to get this worked out (may have a couple more questions). at any rate - i am the only user of this server - it sounds like i should be able make my user keypair work for all sites. probably just need to give ownership of all those dirs to my main user. also "single line" may have been messing me up too. ive been copying and pasting keys into athorized_keys, and i think my editor has been word wrapping... again - thanks for the help!
    – Bosworth99
    Apr 14, 2012 at 15:09
  • ftp must die... lol. awesome site. funny - you spend ten years making web pages via ftp, never gave it a second thought...
    – Bosworth99
    Apr 14, 2012 at 15:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .