Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I understand how I can put my public ssh key in another machines authorized keys using ssh-copy-id provided I have the remote machines username/password.
How is the reverse possible? Getting some remote machine's public key (no password will be required because it is public) and putting it in my own authorized keys (again, no password required as it is mine).
ssh ${remote_host} cat .ssh/id_rsa.pub | tee -a $HOME/.ssh/authorized_keys
ssh-copy-id in reverse, i.e. copy the public key of the user on the remote host into the local authorized_keys. The only thing that has slightly bad wording is "remote machine's public key" instead of "the remote machine's [user's] public key". The oher answers are confused.
Nov 25, 2017 at 12:39
~.ssh/authorized_keys. I couldn't determine how it worked, however, as ssh mysite.com does not provide any results. Please explain the individual actions it performs.
Nov 25, 2017 at 13:16
ssh ${remote_host} cat /home/user/.ssh/id_rsa.pub. And second action is tee -a command that will append output of first command (that is remote user's public key) to your local authorized_keys file. "ssh-copy-id but reverse" as I understand your requirements.
Nov 25, 2017 at 18:43
You're conflating two different types of SSH keys there. Although they are similar in structure, they have a very different purpose.
Your public key is what could be called a user key: although it is public, i.e. there is no need to keep it secret, it is not published automatically by any means. If you want to put it on your web page, sure, you can do that. But you must do it on your own.
The per-machine keys, on the other hand, are called host keys. Those are exchanged automatically at login, so they can be considered published. But host keys don't go into an authorized_keys file: they go into known_hosts instead. Just having the host key from some machine won't give anyone any kind of access: it just lets your SSH client confirm that the machine is the same as before when you connect to it.
If the system administrator chooses to enable HostbasedAuthentication in /etc/ssh/sshd_config, and the host key of the remote host is in system-wide /etc/ssh/ssh_known_hosts file, then it would be possible to add the name of the remote host to /etc/hosts.equiv or /etc/ssh/shosts.equiv to allow everyone on that remote host to log onto corresponding accounts on the local host, without entering a password. If the system administrator also sets IgnoreRhosts to no, then you as a regular user could similarly allow a specific user on a specific remote host to access your account on the local host without a password, by putting the host key of the remote host to your ~/.ssh/known_hosts and the username@hostname into your ~/.rhosts or ~/.shosts. But this authentication method is disabled by default.
(Why two files like ~/.shosts and ~/.rhosts, you think? Well, it's because the .rhosts file was used by the old non-encrypted rsh/rlogin/rexec/rcp tools, and SSH was originally designed as a drop-in replacement for it. You'd use .rhosts or hosts.equiv if you wanted to allow access via both rsh and ssh tools, and .shosts or shosts.equiv if you wanted to allow only SSH access.)
/home/someuser/.ssh/id_rsa.pub etc and place it in my ~/.ssh/authorized_keys so that the other user can access my account on my server without a password.
Nov 25, 2017 at 12:08
By using ssh-keyscan or automatically when connecting to an unknown host which will add the key to known_hosts for you. If you want to do it manually you can use the command below:
ssh-keyscan hostname >> ~/.ssh/known_hosts
ssh-keyscan google.com doesn't return anything, yet ssh-keyscan mydomain.com returns a ssh-rsa key and a ecdsa-sha2-nistp256` key. I then verified that these keys are included as /etc/ssh/ssh_host_rsa_key.pub and ssh_host_ecdsa_key.pub (my /etc/ssh_host_ed25519_key.pub key doesn't come across). Regardless, I don't believe these allow one to logon without a password but only to confirm the host.
Nov 25, 2017 at 12:19