≡ Menu

Howto use multiple SSH keys for password less login


I've already written about howto log in, on your local system, and make passwordless ssh connections using ssh-keygen command. However, you cannot just follow these instructions over and over again, as you will overwrite the previous keys.

It is also possible to upload multiple public keys to your remote server, allowing one or more users to log in without a password from different computers.

Step # 1: Generate first ssh key

Type the following command to generate your first public and private key on a local workstation. Next provide the required input or accept the defaults. Please do not change the filename and directory location.
workstation#1 $ ssh-keygen -t rsa
Finally, copy your public key to your remote server using scp
workstation#1 $ scp ~/.ssh/id_rsa.pub user@remote.server.com:.ssh/authorized_keys

Step # 2: Generate next/multiple ssh key

a) Login to 2nd workstation

b) Download original the authorized_keys file from remote server using scp:
workstation#2 $ scp user@remote.server.com:.ssh/authorized_keys ~/.ssh

c) Now create the new pub/private key:
workstation#2 $ ssh-keygen -t rsa

d) Now you have new public key. APPEND this key to the downloaded authorized_keys file using cat command:
workstation#2 $ cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

e) Finally upload authorized_keys to remote server again:
workstation#2 $ scp ~/.ssh/authorized_keys user@remote.server.com:.ssh/

You can repeat step #2 for each user or workstations for remote server.

Step #3: Test your setup

Now try to login from Workstation #1, #2 and so on to remote server. You should not be asked for a password:
workstation#1 $ ssh user@remote.server.com
workstation#2 $ ssh user@remote.server.com

Updated for accuracy.

Tweet itFacebook itGoogle+ itPDF itFound an error/typo on this page?

Comments on this entry are closed.

  • Dillip October 17, 2007, 11:49 am

    Sir

    After creation of key in pc-1 (id_rsa.pub) copy to pc-2 as authorized_keys but I am not able to ssh username@pc-2, against it is now asking password.

    Kindly help

    Dillip Dhala
    dkdhal1@gmail.com

  • ns November 5, 2007, 4:42 pm

    @Dillip

    It might be that you are using SSLv2 in which case you have to copy/append the key to authorized_keys2

  • Malyadri January 27, 2008, 5:48 pm

    Good tutorial…..

  • matt February 29, 2008, 5:00 pm

    I do something like this:

    cat .ssh/id_rsa.pub | ssh user@server “cat >> .ssh/authorized_keys”

  • Mikko May 7, 2008, 1:02 pm

    e) Should be like

    workstation#2 $ scp ~/.ssh/authorized_keys user@remote.server.com:.ssh/

    instead of

    workstation#2 $ scp ~/.ssh/id_rsa.pub user@remote.server.com:.ssh/authorized_keys
    (this ruins the whole idea)

    :)

  • nixCraft May 7, 2008, 1:34 pm

    Mikko,

    thanks for the heads up!

  • yh March 16, 2009, 8:40 am

    Can i know why need to append own public key to own authorized_keys?
    i thought own public key is used for others?
    web1 id_rsa.pub append to web2 authorized_keys (correct)
    web2 id_rsa.pub append to web1 authorized_keys (correct)
    web2 id_rsa.pub append to web2 authorized_keys (doubt)

  • pixeldoc April 2, 2009, 11:00 pm

    if you have trouble login to your server, check if /etc/ssh/sshd_config contains Protocol 2
    PubkeyAuthentication yes
    .

  • Ron July 24, 2009, 11:12 am

    Thanks. We have added this to our intranet wiki, just for future ;)

  • Matt September 8, 2009, 6:37 pm

    Check out the ssh-copy-id command. It will take care of appending your public key onto the remote system.

  • jay September 24, 2011, 2:29 pm

    Hi folks,

    Currently,for instance, many servers can do passwordless ssh to SERVER A
    Now,we are migrating all the stuff from Server A to Server B.
    all those servers which were connecting to Server A,now need to connect to Server B.
    Can i copy over the authorized_keys file from A to B ,so all those servers can connect to server B passwordlessly.
    The idea is to avoid all those servers keys addition to server B /etc/ssh/auth_keys/ file.

    Does it matter if platform(solaris to linux,vice versa)is different?

    2nd case:
    Server A connects to other servers using ssh which is passwordless. ServerA will be replaced by server B.
    do i need to send Servers’ B pub key to all those other servers have them add serverB pub key in their authorized key file?
    Or to avoid this, can i just copy over the pub key pair from server A to Server B,so other servers wont have to make any change on their side.

  • chika.tambun April 9, 2012, 6:14 am

    well how to enabling it from windows putty… is it possible?

    • Tom April 30, 2013, 8:38 pm

      PuTTY comes with a utility called pageant (C:\Program Files\PuTTY\pageant.exe probably) that you load at startup– in your startup group. The icon there should read”C:\Program Files\PuTTY\pageant.exe” “C:\Program Files\PuTTY\id_rsa_putty.ppk” or something like that. Then your key is always available.

  • Viktor February 14, 2013, 3:00 pm

    Hi,

    I have a question.
    I have two different servers, but they have the same home directory (it’s a network path that is mapped to the home dirrectory on each server).
    I want to be able to ssh without a password from one server to the other, I’ve tried these steps, but wasn’t successfull because I think both servers share the same files.

    Is there a way around this?

    Can I create a key and save it in some other area and use that during ssh command?

    Thanks

  • Viktor February 14, 2013, 3:13 pm

    Nevermind, I figured it out. I guess somehow I deleted id file…

  • adq890 December 25, 2013, 2:51 pm

    thanks for the guide…share in my blog.

  • Harish June 10, 2014, 6:37 am

    Hello,

    I have a problem with ssh password less login with nis users, when user login from client to server.

    i normally follow the steps below to fix ssh password less login and it works for few users but not for few, please help with steps to fix this issue.

    host:user1# ssh-keygen -t rsa
    host:user1# ssh-copy-id -i ~/.ssh/id_rsa.pub user1@server.com

    Thanks
    Harish

  • arielCo August 20, 2014, 3:13 pm

    You’re doing something terribly wrong in Step 2b. You don’t need to and must not copy the remote authorized_keys to any other .ssh/ (the workstation’s in this example); you’re effectively clobbering the workstation’s authorized_keys and granting access to your to every user with access to the server.

    A simpler, safer procedure, is appending every id_rsa.pub to the host’s .ssh/authorized_keys remotely:

    workstation1 $ cat ~/.ssh/id_rsa.pub | ssh user@server “cat >> .ssh/authorized_keys”
    workstation2 $ cat ~/.ssh/id_rsa.pub | ssh user@server “cat >> .ssh/authorized_keys”
    workstation3 $ cat ~/.ssh/id_rsa.pub | ssh user@server “cat >> .ssh/authorized_keys”

  • Marco van Hulten January 21, 2015, 10:21 am

    While nixCraft’s method may work, it is complicated and insecure. Please, follow arielCo’s advice.

    Alternatively, I usually have at least two terminals open, say one on for the local workstation and one where I connected to the server. I simply copy and paste the content of id_rsa.pub to the authorized_keys file on the server.

    Two problems with nixCraft’s method:

    – there is the danger you unintentionally overwrite files, e.g. if the authorized_keys already had useful keys to begin with;
    – the side effect that you leave an authorized_keys file on workstation2 (arielCo’s point about clobbering).

  • Strong But Weak February 12, 2015, 5:44 am

    So when any new user runs ‘ssh-keygen -t rsa’ and then proceeds to create the respective priv/pub keys, must the user use a passphrase? Or should the new user ommit that (e.g: leave empty).