I've noticed that when I create instance in AWS, AWS creates private key file for this instance, then I download this private key file to my local machine and then connect to this instance via ssh -i <this_private_key> user@aws-ip-address.

I try to use this authentication scheme for other linux server in other cloud: simply copy private key from ~/.ssh/id_rsa and save it, then try to connect from one ubuntu server to to this machine where I copy private key and connection refused. I know that in usual I need to generate SSH keypair PUBLIC key to authorized_keys file on remote server and I always use this method, but I interested in AWS scheme, how it works. Can I connect to remote server in other clouds or virtual machines located on my PC like I do it in AWS - only with private key of remote machine.

1 Answer 1


SSH certificate authentication (PKI) uses a private key, which is private, and a public key, which does not need to be kept secret. When you set up a connection for PKI, your private key remains securely with you on the client and your corresponding public key is placed on the server. You can have multiple public/private key pairs and tell ssh which one to use (either on the command line with ssh -i {identity_file} or in the configuration file per host block).

AWS probably generates the public/private key for a login to the new instance as a convenience. You download the private key over a secure connection and store it locally. It already has the public key so from this point forward the combination of your copy of the private key and its copy of the public key allow verification of the connection attempt.

When you run the command ssh -i {private_key} {remote_host}… what's actually happening is that the ssh command uses this private key as part of the negotiation to establish the connection. It's unlikely anything else will have the public key unless you have copied it to a different target.

You can place the same public key on as many remote machines as you like. Your instance of the private key can then verify your access to any of these remote machines.

You should not share the private key by copying it to other servers. Instead, where feasible you should generate a separate public/private key combination for each place that you want to treat as a client (i.e. from where you initiate an ssh connection), and copy the newly created public key to the appropriate target servers.

Finally, you ask, "Can I connect to remote server in other clouds or virtual machines located on my PC like I do it in AWS - only with private key of remote machine?" You can only connect to a remote server that has a public key corresponding to one of your private keys.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .