5

I have ubuntu server at home, and I use SSH keys to log in via terminal from my laptop. Rarely, but mostly from work, I need to access this server, but I dont want to copy keys on my work laptop - Id rather just use plain password for that.

So if I enable password log in from ssh config file, it will ask me password on my laptop too even though it contains keys, right?

Is there a way to stop this behavior?

Thanks.

Improve this question

3 Answers 3

Reset to default
3

Use two private keys

Set up your workstation using the same process (but not the same private key) as you did when you set up your laptop:

  • There is never a good reason to copy a private key from some other machine. If you haven't already generated a fresh private key on your workstation, do so now. Also generate the corresponding public key. In a terminal on your workstation,

type: ssh-keygen -t rsa

  • Copy your workstation's public key to the server. In a terminal on your workstation,

type: ssh-copy-id [email protected]

(but use your actual username and hostname, and later type in your password when it asks for it).

This installs the public key of your workstation into the ~/.ssh/authorized_keys file for that user on the server.

  • There is no step 3. From now on, you can log into the server from your workstation, and you never copied your laptop's secret private key from your laptop.

details

I assume that what you are really asking is

  • I have an Ubuntu server ("home")
  • I log in to my Ubuntu server from my personal laptop ("laptop")
  • I also log in to my Ubuntu server from my work computer ("workstation").

What is the right way to do that?

  • I suppose I could simply log in with the same password from both places. That can't be the right way, because everyone says that public key authentication is much better than passwords. (a)
  • I suppose I could simply copy the private key from my laptop to my workstation. That can't be the right way, because everyone says that the private key is never supposed to leave the client machine.

People have it hammered into their head that one account on a server has a single username and, of course, a single authorized password.

Public-key systems like ssh are better than the password system: One account on a server has a single username and any number of authorized public keys, all of them listed in the ~/.ssh/authorized_keys file.

(more details).

Improve this answer
1

It is possible to force your laptop to use the keyfile even if both the password and keybased approach are available. If you're currently connecting with ssh [email protected] -p 22, edit ~/.ssh/config and add:

Host your.host.tld
    PreferredAuthentications publickey

This configuration file can be used to make you type even less:

Host home
    Hostname your.host.tld
    User user
    PreferredAuthentications publickey
    Port 22

With that configuration, you just need ssh home.

It's possible to restrict password-based logins to a certain IP address. In /etc/ssh/sshd_config, you'd have a line that disabled password-based auth: PasswordAuthentication no. To enable it for logins from a certain IP, you could use:

Match Address 12.34.56.78
    PasswordAuthentication yes

I suggest you to use keybased auth even if on work. It's much safer than password-based auth as it cannot be bruteforced that easily. You can have multiple keys for the same account, that should not be an issue.

For more fancy configuration directives, see the manual page of ssh_config(5). (for the server side, see sshd_config(5))

Improve this answer
2
  • thats an awesome trick! I have seen people do this at my work, and was ashamed to ask :=) thanks. Till now I had .ssh scripts that just had line of command inside them.
    – user25389
    Apr 14, 2012 at 19:52
  • 1
    Another advantage of using the ssh config file over scripts with ssh options in it is that commands like sftp and scp also work with it. Consider the case where you need to copy a file quickly. Then it suffices to run scp home:.vimrc ~ to copy .vimrc from your remote home directory in the local home dir.
    – Lekensteyn
    Apr 14, 2012 at 19:55
1

No, at least with the configuration I have if you enable password authentication it will only prompt for the password if you do not have a key.

That being said -- I would never enable password authentication on a server exposed to the Internet.

Improve this answer
3
  • hey, thanks for response. Is it such a big security risk?
    – user25389
    Apr 14, 2012 at 19:40
  • Yeah it is. It allows people to brute-force attack the username and password fields. Even if they don't get in, it can cause a whole slew of issues. Fore example, I need to move mine to ssh-based authentication because my hosts.deny file is getting too large, due to using fail2ban to limit the amount of abuse ssh username login gets.
    – SinaCutie
    Apr 14, 2012 at 19:46
  • Just create a different key pair for your PC @work. That way you can block the key@work separately from your key@home.
    – jippie
    Apr 14, 2012 at 19:59

You must log in to answer this question.