0

I am working with a group of servers on a VPN with ubuntu 18.04, and for each server I have a different key file. However, when I try to securely copy files (like securely propagate munge key across servers) I am denied as I don't have an appropriate key (at least I think that is the reason, it returns "Permission denied (publickey).").

Keeping my private keys on each server is probably a bad practice? Copying files to my local machine and then copying them to a different server is a pain, and I am not sure if that is secure either.

How is this properly handled? Can I use a user on each server (like munge) to copy between them, if not to any location then to some designated folders which I can later sudo cp? Is there an option that is not a vulnerability?

1
  • Why do you have multiple ssh keys? Aug 26, 2020 at 15:27

2 Answers 2

0

Key based authentication with ssh (scp is an offshoot of ssh) is a question of public key cryptography. You personally have a private key you keep secret and distribute your public key to all.

So to address your question, you should NOT and don't need multiple private keys, one will suffice. Then you upload your public keys at ALL of the servers. You should keep a backup of your private key in someplace safe and encrypted with a passphrase.

Secondly, it is against the philosophy of public key cryptography to store your private keys on the servers you are accessing; you are not keeping the private key secret. Your private key should be safe and sound with you and kept secret from everyone; only you should have the private key and no one else.

Also it is a good practice to use your same username and public key across servers.

So keep your single private key safe with you and distribute the public key to all the servers you wish to access. Now you can use that same private key to log into all your servers!

0

If you need to exchange data between servers, you may look at scp -3 server1:path1 server2:path2. It will transfer the data and using you host as man in the middle (without direct connection between the servers).

You may also configure your .ssh/config file with IdentityFile option set for each server block :

Host server1
  IdentityFile ~/.ssh/file1
Host server2
  IdentityFile ~/.ssh/file2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .