The general process is to generate a pair of public and private keys and upload the public key to the server for SSH connection.

Then, if I have to manage a large amount of servers, am I supposed to:

  1. Reuse that public key for all servers?


  1. Generate different key pairs for each of those server.

I personally believe the first choice is good enough from the security perspective. Am I correct?



The general answer is that you likely will want to put the same personal public key on all servers/accounts you want to login in on. For all practical purposes it's more or less impossible to derive the private key from the corresponding public half.

Then there are a bunch of potential exceptions.

  • While it's normally a good rule to keep the private key passphrase protected that might be less doable while performing certain automated tasks. For that purpose you might also want to have a separate keypair with an unencrypted private key, to use towards those certain (hopefully restricted) accounts.

  • Assuming you mostly connect towards modern enough servers your personal ssh key might be of the ed25519 kind. You might then for compatibility reasons also need a secondary keypair of the RSA kind to be able to login to servers running an older version of OpenSSH. Except that in such a case it's probably good enough to go RSA all the way.

  • If you use ssh agent forwarding a lot there is a theoretical benefit in using separate keypairs, limiting the damage a malicious server can do. Except that I imagine this quickly becoming messy in practice. Probably better then to simply stay away from agent forwarding then.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.