When I have a private key loaded for a user, I can run ssh-copy-id user@remotehostname
and will be prompted for a password. When I enter the correct password, I can now log in with the key. I have previously always run this command with -i <path to public key>
as an argument, but now realize I don't need the path to the public key.
When I log in as user@hostname, I cat the .ssh/authorized_keys file, and see the public key that my private key matches, which is what confuses me - I never provided a public key.
How does ssh-copy-id know which public key matches the private key I have loaded locally when I run the command? How does it know what to add to the authorized keys file when I don't provide it?
I hope I am being clear - I've always run ssh-copy-id -i <public key>
and it makes sense to me how this works - it logs in and copies the public key to the authorized keys file. But if I DON'T provide the public key (i.e. I run ssh-add <private key>
before running ssh-copy-id), it still works as long as I have the private key loaded, and I don't understand how it gets the public key.
edit: To clarify, I am not keeping the default id*.pub naming convention. So the logic that I'm seeing about searching for an id*.pub in the man page doesn't seem to apply. In fact, I can create a keypair called randompair, load randompair, rename rendompair.pub as newname.pub, run ssh-copy-id and it still loads the correct public key.
Looking at the bash script itself leaves me a little confused as to how it accomplishes this.
ssh-copy-id
is a shell script. It's not difficult to read it and see how it works. – Kenster Jul 30 at 18:27ssh-keygen -y
), so the private key is really all you need, but I guess that wasn't your question... – frostschutz Jul 30 at 18:41