Is it possible to use ssh-copy-id once password based logins are disabled?

Question

Is it possible to use ssh-copy-id once password based logins are disabled? Otherwise, is there an utility for adding an authorized public key to a user or should I edit the ~/.ssh/authorized_keys file manually?

Answer 1

If you have multiple ssh keys and already have one set up for authentication on the server or if you have some other non-password authentication system in place, I believe you can use ssh-copy-id to copy a ssh identity to the server. In the ssh-copy-id manual page it says:

ssh-copy-id is a script that uses ssh to log into a remote machine (presumably using a login password, so password authentication should be enabled, unless you've done some clever use of multiple identities)

ssh-copy-id uses ssh to log into the remote machine, so if you can currently log into the machine, you can use ssh-copy-id. If you can not log into the machine, then you can not use ssh-copy-id. New id's will be appended to ~/.ssh/authorized_keys.

Answer 2

Just tried it, and it doesn't look like it's possible.

Confirm that we have passwordless SSH access:

ssh root@redmine -- 'whoami'
#    root

The secondary public key I want to install

ls amir*
#    amir.pub

Attempt #1:

ssh-copy-id -i amir.pub root@redmine
#    ERROR: failed to open ID file './amir': No such file or directory

This has been reported as OpenSSH bug #2110.

Workaround: create a fake private key

touch amir

ssh-copy-id -i amir.pub root@redmine
#    INFO: attempting to log in with the new key(s), to filter out any that are already installed
#    INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
#    root@redmine's password:

Looks like it's refusing to use the existing key in this case, unless I'm missing something.