if i'd like to have another user be able to ssh into my ec2 instance, is there any pros/cons between generating an ssh key for that user in the ec2 instance, and then copying the private key to that user's local computer, versus the new user generating an ssh key on their local computer and copying the public key to the ec2 instance authorized keys?

would it be more secure if the user just generates ssh key on their local computer since you'd just be copying over the public key and not have to copy a private key over?

1 Answer 1


Before I outline any benefits to either method, I will point out that the industry standard for this type of thing is to generate the key-pair on the client system, not the server, largely because it provides a much better user experience.

Now, for the advantages and disadvantages, they pretty much complement each other, so I'll just list the advantages to each method.

Generating the keys on the client:

  • Direct trivial integration with ssh. If you generate the key with ssh itself and it's your only key, it automatically ends up in the right place to be used by default, thus simplifying things for non-technical users.
  • In theory, the quality of entropy used to generate the key will probably be better on the client system than the EC2 instance (VM"s have notoriously low entropy).
  • The user always knows exactly where the private key is, which is important for verifying the security of the key.
  • If the user already has an SSH key (and as a general rule people using SSH regularly often do), they can just send over the public key for that instead of having to deal with managing multiple key-pairs (which is a pain).

Generating the keys on the EC2 instance:

  • It's trivial to copy the key to the required location on the EC2 instance.
  • Lower load on the client system.
  • It's easier to enforce minimum security requirements.

Note that I explicitly did not list anything above about the security implications of copying a private key instead of a public one. THis is because the security implications are entirely dependent on how secure the mechanism you use to copy them are.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .