3

This might be a stupid question, but what process should be taken to add a user to a system and provide them access when the system requires the use of a ssh keys?

For example on a system that doesn't require a key (password is acceptable), I can add the user, set a temporary password and require them to change it on their next login (which isn't a problem).

On a system that requires a key to access, and the user does not have a key-pair, what is the correct procedure for providing access to a person? From my understanding, a private key should never leave the system, if I generate them one, I would need to send them the key-pair so they could login which goes against the recommendation.

Is there a "upon first login, create a ssh-key pair" option? Or should I just make the user generate a key-pair and have them send me their public key?

5

Is there a "upon first login, create a ssh-key pair" option? Or should I just make the user generate a key-pair and have them send me their public key?

If a password is required, how will they login the first time?

Given your constraints it sounds like you'll have to just have them send you a public key. Depending on how skillful you expect users to be, you might want to provide them with a utility that can help generate this for them. Otherwise, just have them run ssh-keygen and send you the id_rsa.pub file it generates.

  • Fair point. Wasn't thinking. That is the problem with most users, they are all on Windows and unfamiliar with generating key-pairs. Sounds like that is the option I'll have to go to. – Kevin Vasko Jan 12 '17 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.