2

I have recently began making use of RSA Key pairs to login to various servers I manage and wanted to get some insight on best practice as I recently ran into some issues.

Is it best practice to keep only one RSA key on your local and register the same key with each server you are going to login to? I recently tried adding an additional key for a new server I need to access and it was not working correctly.

Thank you in advance.

jnolte
  • 285
  • 1
  • 4
  • 11
  • 2
    Make sure you `chmod 700 ~/.ssh` and `chmod 600 ~/.ssh/authorized_keys` on the server side. ssh wont allow key logins if the .ssh and auth_keys files are overly permissive. – chown Nov 01 '11 at 20:01

1 Answers1

1

I'm not sure if it's "standard" or not, but if you're going to use more than one key you will need to specify which you want to use on the command line or specified per host in your ~/.ssh/config file. From the OpenSSH man page:

     -i identity_file
         Selects a file from which the identity (private key) for public key authentication is read.  The default is
         ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa for protocol
         version 2.  Identity files may also be specified on a per-host basis in the configuration file.  It is pos‐
         sible to have multiple -i options (and multiple identities specified in configuration files).  ssh will
         also try to load certificate information from the filename obtained by appending -cert.pub to identity
         filenames.

Example config entry:

host remote.host.example.com
IdentityFile ~/tmp/example_rsa
Andy M.
  • 126
  • 1
  • Thanks for the insight, this is definitely helpful for adding keys. My main reasoning was to get some insight on best practice and why someone would use one key instead of many. +1 – jnolte Nov 03 '11 at 04:24
  • In practice most people use one key just because it's easier. I've had to use multiple keys before because the admin of a remote site generated my keypair for me and sent me my private key (they did this rather than issue passwords). But that seems to be non-standard. – Andy M. Nov 03 '11 at 13:47