Per the five security guideline from U.S. National Security Agency (which I include all of them for learning reason):
- Encrypt transmitted data whenever possible.
- Minimize software to minimize vulnerability.
- Run different network services on separate systems.
- Configure security tools to improve system robustness.
- Use the principle of least privilege.
The bold one apply to original post.
When you create an SSH key, a pair get generated
- Public key, that ends with .pub. the public key reside in the server.
- Private key, which is a secret and the decision to encrypt the private key depend on how big the damage could be if it get leaked, lost or stolen.
It does not matter who generated the key or where the private key reside. As long as you access to the privateKey and the corresponding publicKey is included in the authorized_keys file at the server. As root, try and authenticate by a regular user privateKey:
~# ssh root@server -o PreferredAuthentications=publickey -i /home/user/.ssh/server_key
Also it nice to include, you should always use ssh-keys and disable password authentication from the configuration file
~$ sudo cat /etc/ssh/sshd_config | grep PasswordAuthentication
$ sudo cat /etc/ssh/sshd_config | grep Pub