Just like AWS EC2 style, how do i setup the way people SSH into my Server to be via the Server's Private Key (PEM?), instead of we uploading Clients Public Keys into Server?

Idea is to share the Server's Private Key (.pem?) to the Clients, so that whoever has that key would be straight away able to SSH into Server. So that there would be no overheads for me (as Server Admin) whenever there are new Client Users/Machines appeared.

That would also mean, as long as we have that Key, we can connect to Server from "any" Client Machines even it is a new one. (That also would probably allow us to go for the vacation without carrying the Particular Laptops, as long as we have the KEY and a random Computer. :D)

How to achieve that (AWS-like) method please?

  • 1
    This is too broad for a Unix & Linux post. Read this article. – Satō Katsura Nov 3 '17 at 11:48
  • 1
    This is too broad? I thought i specifically asked about a particular method to implement. – 夏期劇場 Nov 3 '17 at 11:50
  • "Too broad" as in the answer is too hard to write as a self-contained post. – Satō Katsura Nov 3 '17 at 11:55

No one shares a private key. As @SatōKatsura mentioned, what you are referring to is client certificate authentication. There's a CA, the domain's or other, which signs all user's public keys.

Here's Amazon's description:

Creating a Key Pair

You can use Amazon EC2 to create your key pair. For more information, see Creating a Key Pair Using Amazon EC2.

Alternatively, you could use a third-party tool and then import the public key to Amazon EC2. For more information, see Importing Your Own Public Key to Amazon EC2.

All private keys are always kept private.


The discussion of how to setup SSH Client Certificate Authentication is probably too involved for presentation here. However, Red Hat has a really detailed explanation here

I can try to summarize the process, if need be.

  • 1
    "No one shares a private key" - not necessarily true, but not good practice when it is true. You could, for example, create a key pair for someuser, and give multiple people the private key, and then they could all log in. It's not the servers's private key though, which the OP seems to be suggesting. – EightBitTony Nov 3 '17 at 12:18
  • Thanks so much for a great explanation. So that i came to know it's not about Private Keys. Also, does that also mean CA part is something we cannot easily do, at least, in a same server? – 夏期劇場 Nov 3 '17 at 12:25
  • @夏期劇場 .... added a link in my answer. – RubberStamp Nov 3 '17 at 12:41

This is a violation of the idea behind asymmetric encryption (aka public key cryptography) so this is not possible using the RSA key (RSA=asymmetric crypto).

Why not simply use a (very long) passwort? This will accomplish the same.

You could check other methods of authentication in ssh but they would have no reason to do something less secure than RSA.

  • Thanks for the highlights. But i just wanna know how to achieve the AWS way. – 夏期劇場 Nov 3 '17 at 11:45
  • Do not use SSH :-) – Ned64 Nov 3 '17 at 11:51
  • But AWS made it for SSH. That's why i wanted to ask how to achieve if someone would explain. – 夏期劇場 Nov 3 '17 at 11:54
  • So now in the other answer, which says the same, you accepted the truth. Why not in mine? The contents are the same. – Ned64 Nov 3 '17 at 14:05
  • @Ned64 Your answer is technically incorrect. The public key and the private key could be used to verify the other key. Both keys are capable of encryption. The private key can decrypt messages encrypted with the public key, and the public key can decrypt messages encrypted with the private key. I know this sounds strange, but the private key is generally not used for encryption: See this on crypto stackexchange. The private key is longer and protected with a passphrase. – RubberStamp Nov 3 '17 at 15:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.