13

On an Ubuntu AWS instance I want to ssh in as "thufir" with sudo privileges. Create user thufir with sudo adduser thufir and then adduser thufir sudo from the "ubuntu" user? Simply add my public key to ~/.ssh/authorized_keys and then I'll be able to ssh as "thufir" to the remote instance?

Can I use my regular public key to login as "ubuntu" on AWS, or would that require the AWS generated key?

I'd like to be able to ssh as "ubuntu" using my own key -- is that possible? There's no password with the "ubuntu" user, strictly key login.

3
  • 1
    Yes, all you have to do is get your key into the right place with the right permissions . Do it and test it before you remove the default Amazon provided/generated key.
    – ivanivan
    Nov 12, 2017 at 21:19
  • but the key is tied to a specific user?
    – Thufir
    Nov 12, 2017 at 21:22
  • 1
    No, whatever private key you have will open a matching public key that is present in any users authorized_keys file - you just have to specify the username to connect as
    – ivanivan
    Nov 12, 2017 at 21:34

2 Answers 2

16

The ssh keys are not personalized, so you can create the key under your user and then just paste your public key to the target user's authorized_keys on the remote server.

Thus, if you have key generated on your local workstation under "thufir", and want to logon to remote server as "ubuntu", you need to copy contents of your .ssh/id_rsa.pub to .ssh/authorized_keys of user ubuntu on remote server and use command like

ssh ubuntu@remotehost

If you want to connect as thufir to remote server, then, yes, on the remote server you need to create user thufir, add it to sudoers, then put your public key to the .ssh/authorized_keys of the new user and then you will be able to connect through

ssh thufir@remotehost

or, suggesting you are logged on as thufir to your local box, through

ssh remotehost
6

The same ssh public key can be used to as an authentication key for multiple users on the same system as well as multiple systems.

Simply used ssh-copy-id to send your public key to the remote host. In the case of the ubuntu user, you will need a copy of the private key and use ssh-copy-id ubuntu@aws which will copy your default ssh public key to the ubuntu user's ~/.ssh/authorized_keys file.

The following diagram is meant to be illustrative only, showing the same public key copied to multiple hosts and users.

     .---------------------------------------.
     | aws:/home/thufir/.ssh/authorized_keys |
     |---------------------------------------|
     | ssh-rsa AAAA... user10@host           |
     '---------------------------------------'
                         ^
                         |
                         |
            ssh-copy-id  |      .---------------------------------------.
                         |      | aws:/home/ubuntu/.ssh/authorized_keys |
                     .---'      |---------------------------------------|
                     |          | ssh-rsa AAAA... user10@host           |
                     |          '---------------------------------------'
                     |                              ^
 .---------------------------------------.          |
 |    local:/home/user10/.ssh/id_rsa     |          |  ssh-copy-id
 |              Private Key              |          |
 |---------------------------------------|          | 
 |      BEGIN RSA PRIVATE KEY            |----------.
 | Proc-Type: 4,ENCRYPTED                |          |
 | DEK-Info: AES-                        |          |  ssh-copy-id
 '---------------------------------------'          |
                     |                              v  
                     |          .---------------------------------------.
                     '---.      | aws2:/home/user5/.ssh/authorized_keys |
                         |      |---------------------------------------|
                         |      | ssh-rsa AAAA... user10@host           |
            ssh-copy-id  |      '---------------------------------------'
                         |
                         v
    .----------------------------------------.
    |    aws2:/root/.ssh/authorized_keys     |
    |----------------------------------------|
    | ssh-rsa AAAA... user10@host            |
    '----------------------------------------'
2
  • 1
    I guess it is better to say "id_rsa.pub" and "Public Key" on the diagram, otherwise it may be mistakely read as "private key is being copied to remote hosts", which is incorrect and may be misleading
    – Sasha Che
    May 8, 2020 at 11:35
  • It does seem though that there is a setting that allow any user (user1) to login as any other user2 or user3 if the key of user1 matches, even though the key in not in .ssh/authorized_keys of either user2 or user3. Why would that be?
    – Lifeboy
    Jul 7, 2021 at 17:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .