2

I have some questions regarding generating keys for ssh access:

(1) Supposed there are two computers running ssh server service and I have generated a pair of key files on computer A and copy the public file to computer B. Is it true that this is only a one-way key: We only gave computer A permission to access computer B, not gave computer B permission to access computer A? If I now want to ssh from computer B to computer A, must I generat another pair of key files on computer B and copy the public file to computer A?

(2) If I would like to connect a single local computer to several remote servers, is it to generate a common pair of key files only once on the local and copy the same public file to the remote servers, or to generate different pair of key files on the local for different remote servers?

(3) If I would like to connect several local computers to a single remote server, when copying the public files from different local computers to the remote server, is it to combine them together into a single authorized_keys file or store them in different authorized_keys files?

(4) If there are several servers shared the same file system by, for example, NFS, how to generate keys and arrange the key files for accessing from one server to the other? Also how to still generate keys and arrange the key files for a local computer to access anyone of the servers?

All the machines above are Linux.Please provide examples and commands in your reply so that I can better understand how to solve the problems.

Thanks and regards!

2
  • 1
    I would recommend splitting each of these into its own question...all of them together is a bit of an overload, IMO.
    – Anonymous
    Feb 26, 2010 at 1:29
  • 2
    You shouldn't really cross post to multiple related sites. I've answered on SF (serverfault.com/questions/117007/ssh-key-questions) as I saw it there first and it probably fits there slightly better than SU (though it is probably a valid question for either site, direct cross posting is not generally desired so you'll probably find one of the questions gets closed and the answers merged). Feb 26, 2010 at 2:09

3 Answers 3

3
  1. Yes, this is the case. The machine with the private half of the key can authenticate against those with the public half. You could of course have the same private key on two or more machines, but if you do not have a string passphrase on the key you should not do this for servers you do not 100% trust, such as an external shared server (then again, passphraseless keys are not recommended anyway).

  2. It is common to use the same public key on many servers, just like if using public+private keys for signing email (everyone generally uses the same public key to check signatures from your one private key) - the not above about not withstading. For instance my key for me@homemachine can log me into my home server, my remote server and several VMs. I have a differet pait of keys for me@homeserver though (because of note 1 above) but that can also be used to authenticate me with a selection of accounts elsewhere. That said, there is nothing to stop you having many private keys for each user account you hold if you desire.

  3. All the authorized keys for a given destination account exist in one authorized_keys file.

  4. That depends. Is your home directory, or indeed everything, on the shared (NFS) resource?

http://novosial.org/openssh/publickey-auth/ is a resource that came up after a quick search when answering a related question earlier, and it seems relevant here too though it might not cover your last point. The sample commands will be relevant to Linux assuming you are using OpenSSH (which you no most likely are).

6
  • Thanks David! About question 3, how to put all into a aurthorized-keys file, for example? I also saw that sometimes people use multiple aurthorized-keys files: aurthorized-keys, aurthorized-keys2, aurthorized-keys3 and so on. What is that for?
    – Tim
    Feb 26, 2010 at 2:39
  • About question 4, it is just my home directory. So can I just copy the generated public key file into a aurthorized-keys file under same directory ~/.ssh? Will this work for any server accessing other servers that share the same filesystem?
    – Tim
    Feb 26, 2010 at 2:42
  • authorized_keys2 has been deprecated for some time - just use authorized keys. You can append a key to the file with the >> redirection operator in bash. I normally transfer keys from the source machine in one go with cat ~/.ssh/id_rsa.pub | ssh remoteuser@remote.host.com "cat - `mkdir -p ~/.ssh` >> ~/.ssh/authorized_keys" - that works if it is the first key or an additional one. Feb 26, 2010 at 10:52
  • And yes, as the machines share the same /home your account will have the same keys by default (you can use multiple and specify which to use on the command) so a single entry in authorized_keys will allow you to ssh between them using keys based auth. Feb 26, 2010 at 10:53
  • Private keys are almost always stored on disk along with their public parts. (At least that is the case with GnuPG and SSH/SSL.) If you have just id_rsa, it contains both parts, so the argument in #1 is incorrect.
    – user1686
    Feb 26, 2010 at 13:18
3

(1) Supposed there are two computers running ssh server service and I have generated a pair of key files on computer A and copy the public file to computer B. Is it true that this is only a one-way key: We only gave computer A permission to access computer B, not gave computer B permission to access computer A?

Yes.

If I now want to ssh from computer B to computer A, must I generat another pair of key files on computer B and copy the public file to computer A?

Yes (although you could use the same key files as above, if A and B fully trust each other).

(2) If I would like to connect a single local computer to several remote servers, is it to generate a common pair of key files only once on the local and copy the same public file to the remote servers, or to generate different pair of key files on the local for different remote servers?

While both will work, there's no reason to use more than one key file; so your second option.

(3)

Yes, you combine all keys into one authorized_keys file.

(4) If there are several servers shared the same file system by, for example, NFS, how to generate keys and arrange the key files for accessing from one server to the other? Also how to still generate keys and arrange the key files for a local computer to access anyone of the servers?

NFS does not matter for SSH; the files must just be in the right locations. Same for generating keys.

2
  1. One key pair generated from a Computer 'A' can be used to login to several other Computers.
    However, you can copy the key pair from A's '.ssh' directory to another computer 'B' and then use it from there too (to login to all computers that you have allowed access from 'A' with these credentials).
    This makes the access less secure since you have now shared the private data across two computers. But, it may work if that is not a liability.
  2. Like I described above, a single key pair on 'A' can be used to access as many remote machines as you need by authorizing the access with the public key on each of them.
  3. The 'authorized_keys' file can have multiple authorization lines (public keys), one per line.
  4. When you have shared 'home' space across multiple computers (and the '.ssh' directory itself is therefore shared across them as you login), you need just one key pair to share access across this pool of computers. Place the public key into the authorized_keys file of this '.ssh'.

Some references,

  1. OpenSSH Public Key Authentication
  2. SSH without a password
  3. SSH User Identities (SecurityFocus)

Update:

  • This Cambridge University help page has a sample authorized_keys listing.
  • I think the different files were used to store different key-types.
    Like the 'authorized_keys' file would be for RSA keys and
    the 'authorized_keys2' file for DSA keys maybe.
    There is a SecurityFocus article which describes these files along with other things.
2
  • Thanks nik! About question 3, can you give example of putting all into a aurthorized-keys file? I also saw that sometimes people use multiple aurthorized-keys files: aurthorized-keys, aurthorized-keys2, aurthorized-keys3 and so on. What is that for?
    – Tim
    Feb 26, 2010 at 2:38
  • The extra authorized key files are usually for variations on the protocol. I would recommend you don't use them, just stick to a very simple setup until you are more comfortable with SSH.
    – Chris S
    Feb 26, 2010 at 3:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.