I have su privilege for user foouser on target.host. I went into its ~/.ssh directory and got the public ssh key from id_rsa.pub. I also added it to authorized_keys.

I wanted to enable ssh from another server. I went to that other server and saved the public key in /path/to/foouser.pub and tried running:

ssh -i /path/to/foouser.pub foouser@target.host

but still got prompted for password. Why? Is there something that needs to be changed in the ssh config for foouser on the SSH host?


You need to use your private key, not your public key, with the -i flag.

Since your public key is unable to pass the challenge sent from the other server based on that same public key (asymmetric cryptography, requiring you use the private key to answer the public-key-based challenge), then when key authentication fails ssh proceeds to attempt other authentication methods including password.

The way asymmetric cryptography works is that your private key is kept private. It should not be shared with anyone; it should not even be copied off of the host on which it is created. (And it certainly shouldn't be sent by email!)

The public key can be sent all over the place.

Data encrypted with the public key can only be decrypted by the private key, and data encrypted by the private key can only be decrypted by the public key.

Mathematically, in the RSA algorithm, there is no functional difference between the two keys except that one of them must be kept secret. However, in the actual SSH implementation, the two keys are differentiated and look different, so be sure that:

  • Your public key and NOT your private key is added to the "authorized keys" file on the target server, and
  • You pass your private key to ssh -i. (No harm if you pass your public key to -i, it just won't work.)

If you've ever shared your private key or copied it to the target server, generate a new key and delete the old one.

I just looked more closely at exactly what steps you performed. You need to back up and start over. At this point, you should delete the key pair for foouser on target.host and remove that public key from ANY authorized keys file you've put it in. Private keys should never be copied.

Note that to SSH into foouser@target.host from someother.host does NOT require that foouser even have a key pair.

What is required is that you generate a key pair on someother.host for the user count you will be SSHing from, and that you put the public key of that pair into ~foouser/.ssh/authorized_keys on target.host.

Simple step by step, but omitting the security cleanup steps you should now do since you copied a private key around. Just the simple way to set up connectivity:

  1. On startserver.host, as user startinguser, run ssh-keygen. You can make a passphrase or not; up to you. (A passphrase adds additional safety in case the private key does get compromised.) Just pressing enter at each prompt will create the key pair with default settings, which is fine.
  2. Run cat ~/.ssh/id_rsa.pub to display the public key.
  3. Copy the output of the command onto the other host (target.host) and append it to ~foouser/.ssh/authorized_keys.
  4. From startserver.host, run ssh foouser@target.host. You don't need the -i flag.

To answer the comment:

If private keys should never be copied—can you explain what good is ssh -i when it expects a private key?

You generate the key pair on the host from which you want to ssh to other servers.

Your private key stays on that server and is never copied elsewhere. (Maybe it's in your backups. Maybe not. But for use, it's never copied elsewhere.)

Your public key is copied onto every server you want login access to, and specifically is appended to the authorized_keys file in the .ssh directory in the home directory of the user you want to be able to log in as on that server.

With this setup (the default), you will never need -i. However, you may have more than one key pair on your own computer that you use for different purposes (different sets of servers). The point of -i is to be able to specify an alternate location from which your private key identity will be read. You could accomplish the same effect with cd ~/.ssh; mv id_rsa id_rsa.bak; mv id_rsa.other id_rsa and then just ssh ... without -i. But -i is more convenient.

  • do i then have to add the private key to authorized_keys on the remote host ? – amphibient Oct 17 '17 at 21:46
  • I went and got the private key and saved it under foouser.ppk and chmod 600, then ran the same command using that input file. i got prompted for password again – amphibient Oct 17 '17 at 21:51
  • basically, how do i get SSH connection ? – amphibient Oct 17 '17 at 21:52
  • 1
    actually, they are. i checked using ssh-keygen -y -f ./id_rsa and the value was identical as in startinguser.pub – amphibient Oct 17 '17 at 22:39
  • 1
    If your private key is in PuTTY (ppk) format, it can't be used as the private key with an OpenSSH client. You would need to convert it or generate a new, OpenSSH-formatted key pair. – user4556274 Oct 17 '17 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.