This is for Ubuntu 16.04, if that matters. I tried making a tag but it said I don't have enough rep.

I set up an SFTP server on an Amazon AWS EC2 instance so our clients can transfer files securely. I'm decent at programming and I have a basic grasp over network concepts, however my problem is that I've never worked with Linux before and have no working knowledge of it. I was able to get the server set up and remote into it using both PuTTy and the GUI application WinSCP.

That's great for me, but now I need to set up users for our clients to remote into the server and drop their files.

It seemed to work fine when I used

useradd myuser
passwd myuser

to create my new user. However, I want to generate and add a separate key for each user for them to authenticate with and I'm getting lost and really confused in a sea of browser tabs which include the phrases ~/.ssh/ and authorized_keys.

I know I can use PuTTy to generate a priv/pub key pair and to save the public key into the authorized_keys file. But how do I do that? Also, is there a better way to go about this?

Bonus Question: What's the best practice for sending/receiving a key from/to a client?

I managed to get a user set up and guess I got my own key added to authorized_keys correctly because they were able to get on and drop a test file for me. I ended up sending my own private key to them in an email with the thought that if they messed anything up I would just kill the instance and fire up a new one. I know without having to be told that was a big no-no, but I needed immediate results. Honestly, at around my third day of researching, I briefly entertained the idea of simply doing that for all our clients, but I was worried that would be the genesis of a disturbance which one day causes all celestial bodies in our solar system to perfectly align and allow cosmic energy to flow directly into our sun, ultimately destroying Earth, so instead I am making this post


So I finally figured out how to create and set up a user for SSH and although you could learn this stuff through familiarity like I had to, I think it would be helpful to other newbies if there was a simple list of commands they could look at.

First 2 things, typing sudo in front of your commmand gives you god-mode(run commands as root), if any commands fail, using sudo [command] pretty much always allows you to run it. And also you can look at any commands usage and options with

 man [command]

First of all create the user

useradd -m -d /home/myuser/
passwd myuser

These commands do a few things. Useradd will create a user with any options you specified, or defaults if you didn't

  • -m - Create the home directory if it does not already exist, must also have -d. Be aware that you don't capitalize -M because that option explicitly does not create a home directory
  • -d - Explicitly set the users home directory to /home/myuser/

With those commands we have created a user called myuser, set it's password(you can just press enter a few times using the passwd command to make a blank password), and finally set it's home directory

Now these might be created automatically honestly I can't really remember, but if you plan to connect using SSH your home directory must have an .ssh directory and that directory must have an authorized_keys file

 mkdir /home/myuser/.ssh/
 echo "" > /home/myuser/.ssh/authorized_keys

mkdir should be pretty self explanatory but echo has done some crazy stuff. First of all the echo command simply outputs...nothing, to standard output(stdout, or just the terminal). But we've used > here which is a special redirection character which is saying "hey, take stdout and send that data here", which in our case is a file located at /home/myuser/.ssh/authorized_keys. Visit this link to learn all about redirects in linux

Now the part that confused me, generate the keys and put the public key on the server. Doing this from the terminal itself is at least a thousand times easier than figuring it all out with puttygen.

 ssh-keygen -t rsa -C "myuser@myhost"

You will need to know your hostname, or you can use the hostname command to output it to stdout, you could create the keypair without specifying the host but I think you'll need to change it later for it to actually work and that's kind of a PITA so it's better if we can do it now. All you have to do is run this command and follow the prompts, for this post, I'll assume you used the defaults.

Add the public key to the users authorized_keys file

 cat ~/.ssh/id_rsa.pub >> /home/myuser/.ssh/authorized_keys
 echo -e "\n" >> /home/myuser/.ssh/authorized_keys

There's a lot of stuff going on here so let me explain. ~ is a shorthand essentially that means currently logged in user's home directory. cat is a command used to read files, we will read the file ~/.ssh/id_rsa.pub and redirect stdout in append mode to /home/myuser/.ssh/authorized_keys. Then we need to add a new line to the file because every public key should be on it's own line. Again using echo we will pass "\n" to stdout but this time with the option -e which says "perform the escaped character's function, not output"

Lastly, the whole point of this is security, right? So let's restrict users to just their home directory

 chmod -R 700 /home/myuser/
 chmod 600 /home/myuser/.ssh/authorized_keys
 chown -R myuser /home/myuser/

You know you can use the man command to look at the documentation for any commands so I'll let you guys figure out what those do on your own.

Lastly, at this point the easiest thing to do is to use an SFTP client, log into the server, then copy the private key to your local machine, this can then be sent via secure email, or better yet your clients can figure out how to create their own damn keypair and send you just the public key.

I hope this helps somebody eventually

| improve this answer | |
  • echo "" > /home/myuser/.ssh/authorized_keys is a roundabout way of touch ~myuser/.ssh/authorized_keys. Generally, you should not be creating keys for your users; you would create the user account, but the users should generate their own keys on their own system, and send you the public key, while keeping the private key private on their own computer(s). – user4556274 May 30 '19 at 20:24
  • @user4556274 Thanks for pointing out the touch command, I had no idea about it. I'm not going to edit the post because there's no easy way to segue into an aside about redirects which is very useful for beginners to know about, and additionally any future readers should just read your comment. Regarding key generation, it was done locally this time due to client request but I do know best practice and I even already had it in the post – DreadedEntity May 31 '19 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.