I need to enable password less key based login between two hosts, however I am unable to wrap my head around how this actually works under the hood. So looking some helm to get my concepts cleared.

I am on host1 logged in as user1. Now from here I plan to remotely execute a command on host2.

[user1@host1 ~]$ ssh user2@host2 pwd
The authenticity of host 'host2 (***.***.***.*)' can't be established.
ECDSA key fingerprint is SHA256:******************.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'host2,***.***.***.*' (ECDSA) to the list of known hosts.
user2@host2's password:

What am I confused here, to enable password less login for user2@host2.

  1. Do I need to add user1's public key [~/.ssh/id_*.pub] generated on host1 to the authorized keys on host2 under user1's ssh/authorized_keys, since on host1 I am logged in with user1?, Or
  2. Do I need to add user2's public key [~/.ssh/id_*.pub] generated on host1 to authorized keys on host2 under user1's ssh/authorized_keys'? Or
  3. Do I need to add user2's public key [~/.ssh/id_*.pub] generated on host1 to authorized keys on host2 under user2's ssh/authorized_keys'? Or

Sorry if this is too basic or confusing question, I tried my best to explain what I am confused about. TIA!

  • 1
    You are in the source pc as source user. You want to connect the destination pc as destination user. [sourcehost@sourceuser] : ssh destinationuser@destinationpc Your key come from sourceuser .ssh/id_rsa and the destination pc check it. => if the sourceuser public key is in the destination user's authorized_keys, you can log in.
    – K-attila-
    Jul 26, 2022 at 15:02
  • @K-att- so i can login and execute as destinationuser without using any of its password or keys? In other words, how i can i use sourceuser's credentials to work as destinationuser Jul 26, 2022 at 15:27
  • 1
    With your key. Your public pair of your key need to include into the destinationuser authoried_keys file. The destinationuser allow the login for the owner of the secret key (sourceuser). In the destination pc you use the destination user's credentials.
    – K-attila-
    Jul 26, 2022 at 15:34
  • 1
    Instead of random usernames, assume persons. bob@a wants to ssh to b, so he first has to add his public key to bs authorized_keys file by providing a password (or another already setup private key), proving its him. Then he can use his new key.
    – Panki
    Jul 26, 2022 at 19:57
  • Just change ssh to ssh-copy-id
    – balki
    Jul 26, 2022 at 20:23

1 Answer 1


If you're using SSH Public Key (password less) login, then this is my understanding of what's going on.

  1. You generate a private key / public key pair for use with SSH. E.g. using the ssh-keygen command utility.

  2. You put the private key into a file on the source PC, accessible only to the user that will initiate the ssh connection from the source PC. In your case, you put this into a file like ~user1/.ssh/id_ecdsa on host1.

  3. You put the public key into a file on the destination PC, accessible to the user that you wish to become on the destination PC. In your case, you put this into a file like ~user2/.ssh/authorized_keys on host2.

Note: The only connection between the key pair and a user is the fact that you place the keys in that user's ~/.ssh directory. The keys themselves don't have any functional connection to a specific user (although, in many cases, the comment at the end of a line in the authorized_keys / id_*.pub files may give you the impression that a key is tied to a specific user).

Note: The key pair can be generated anywhere there is some utility to do so. The pair does not have to be generated on either the source or destination hosts.

Note: Assumes password less authentication is enabled, which is likely the default.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .