This is not about copying the public key on the server and then ssh-ing, if you're going to suggest that.

So I made an AWS Linux instance, and I made an ssh key pair, and it automatically downloaded the private key.

Now I can connect to my AWS Linux instance by simply:

ssh -i key_they_gave_me ec2-user@AWSinstanceIP

How do I set this kind of thing up for my own Linux vms? So that somebody can just ssh into it with the private key, without needing a password?

EDIT: I am not talking about copying the id_rsa.pub. I know how to do that, and the AWS instance does not require that. That's what I want.


3 Answers 3


Empty passphrases are permitted with SSH. You can replicate it with ssh-keygen by simply pressing enter when prompted for a passphrase. From man ssh-keygen:

The program also asks for a passphrase. The passphrase may be empty to indicate no passphrase (host keys must have an empty passphrase), or it may be a string of arbitrary length.

This is standard behaviour for keys generated as part of various cloud services. I expect you would find the same thing happens if you used Google or Microsoft clouds. It might seem insecure but the alternatives aren't great either. Somehow they need to give you access to the VM.

For anyone worried about security, ssh-keygen also has a function for changing the passphrase on the private key without needing to change the public key:

ssh-keygen -p -f key_they_gave_me

Personally I have passphrases on by default, but store passphraseless keys inside a LUKS volume. When I know I'm about to be sshing a lot, I mount the passphraseless keys over the top of the default keys. When I'm done work I unmount so any intruder still has to deal with a passphrase. This obviates the need for ssh-agent a lot of the time while giving a lot of control over how secure the keys are.


You're asking about how AWS's infrastructure generates ssh keys. Unless anyone who works for AWS and is allowed to disclose that information (highly unlikely) then you won't get a complete answer.

On top of that, the answer you'll be looking for entirely depends on what virtualization back-end you use.

That being said, what is publicly available knowledge from AWS is that they now use their own home-brewed KVM virtualization platform rather than XEN like they used to use.

So we can hazard a guess at how AWS do it, or at least provide a method of doing this via a kvm host. The most common way that I'm aware of is using virt-sysprep on a qcow2 image with the --ssh-inject flag.


firstly generate the public key on the kvmhost with ssh-keygen. Lets say your user is iamAguest and you've stored the new public key in /home/iamAguest/.ssh/id_rsa.pub

You'd then run virt-sysprep to inject those keys into an image:

virt-sysprep -a a_linux_image.qcow2 --run-command 'useradd iamAguest' --ssh-inject iamAguest:file:/home/iamAguest/.ssh/id_rsa.pub 

Then once you deploy an instance using that image a_linux_image.qcow2, you should then be able to ssh in using your new generated keys.

how does amazon do this at a click of a button?

A simple enough script could do this, but on a platform of AWS's scale, it would no doubt be quite complex.

If you're just running a kvm instance of your own, something as simple as this could do the trick:


# get image and user from user input

# fail if no user input
if [ -z "$image" ] || [ -z "$user" ]; then
    echo "you must enter a filepath to an image and a user name to run this"
    echo "e.g: inject_ssh.bash <image> <user>"
    exit 1

# create ssh key for current logged in user with no passphrase
echo -e "/home/$user/.ssh/id_rsa\n\n" | ssh-keygen

# inject key into image 
virt-sysprep -a $image --run-command "useradd $user" --ssh-inject $user:file:/home/$user/.ssh/id_rsa.pub

Note however that it'd be a good idea to copy the image first, so you still have a clean one without any keys, if you're planning on providing this as a consumer solution. It would also be a good idea to put more validation in the script; it's just a simple example as it stands.

  • 1
    In other words, it's not something intrinsic to ssh, thanks. You provided the only answer that was actually relevant, kudos!
    – iamAguest
    Aug 30, 2018 at 11:18

I actually found out the way to do it. It's really simple actually.

Let's say you have machine1 and machine2, and you want to be able to access machine2 from machine1 without handling machine1's key, through a method that would let machine1's user access machine2 even from another machine other than machine1.

You do the ssh-keygen on machine2. You do cat /path/.ssh/id_rsa.pub >> /path/.ssh/authorized_keys, then chmod 600 /path/.ssh/authorized_keys, then finally you copy the id_rsa as a permission.pem file and give it to machine1.

This way machine1 can connect to machine2 doing ssh -i permission.pem thatuser@machine2. The user of machine1 can take the permission.pem with him and connect to machine2 without a password from any machine.

Of course this is insecure, but you could also use a passphrase. What I wanted to know was as a CONCEPT how to do it. This answers it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .