SSH key authentication with another user

Question

I'm confusing myself on some ssh key-based authentication.

Let's say I have:

Host A:
user tom
  .ssh
     tom_private_key
     tom_public_key



Host B:
user shared
   .ssh
     shared_private_key
     shared_public_key

I want to SSH from Host A, as user shared, into Host B.

Would I have to copy the shared user's private key to my ssh directory and then use the -I parameter or setup an SSH config file so that when I ssh to that host as user shared, the shared user's private key is used?

There's not a way to do this without copying the private key is there? I don't think so, but I'd obviously like to avoid copying around private keys if I can.

Answer 1

You need to populate the ~/.ssh/authorized_keys file on Host B with the public keys of all the users you want to have access to the shared account. Only the client needs the user's private key. The server only needs to know the public keys which are allowed to connect to a given account.

There is rarely a need for users to share private keys (the well-known Vagrant private key is an illustrative exception), or to place the users' private keys on the server. Each private key should be unique to each user and should remain on his or her client machine. Even if you disregard this best practice, you still don't need to put the shared-user's private key on the server; you just need to distribute a copy of the private key to every user who will be using that key to connect to the shared account.

Answer 2

If you SSH from your laptop to Host A you can store private key locally and use agent forwarding (ssh -A host_a).

Answer 3

Doing this on Host A:

cat ~tom/.ssh/tom_public_key | ssh shared@host-b 'cat >> .ssh/authorized_keys'

Let's you do (again on Host A):

ssh -i ~tom/.ssh/tom_private_key shared@host-b

In the first line you copy Tom's public key from Host A (host-a:~tom/.ssh/tom_public_key) to Host B into the Shared-User's authorized_keys-file (host-b:~shared/.ssh/authorized_keys), then you can connect (second line) from A to B without password:

You can have multiple public keys in the the authorized_keys-file (one per line) and use the same public key for multiple remote hosts. You can also use the same private key on multiple machines but I'd call thad bad practice.