I have ubuntu server at home, and I use SSH keys to log in via terminal from my laptop. Rarely, but mostly from work, I need to access this server, but I dont want to copy keys on my work laptop - Id rather just use plain password for that.

So if I enable password log in from ssh config file, it will ask me password on my laptop too even though it contains keys, right?

Is there a way to stop this behavior?



It is possible to force your laptop to use the keyfile even if both the password and keybased approach are available. If you're currently connecting with ssh user@your.host.tld -p 22, edit ~/.ssh/config and add:

Host your.host.tld
    PreferredAuthentications publickey

This configuration file can be used to make you type even less:

Host home
    Hostname your.host.tld
    User user
    PreferredAuthentications publickey
    Port 22

With that configuration, you just need ssh home.

It's possible to restrict password-based logins to a certain IP address. In /etc/ssh/sshd_config, you'd have a line that disabled password-based auth: PasswordAuthentication no. To enable it for logins from a certain IP, you could use:

Match Address
    PasswordAuthentication yes

I suggest you to use keybased auth even if on work. It's much safer than password-based auth as it cannot be bruteforced that easily. You can have multiple keys for the same account, that should not be an issue.

For more fancy configuration directives, see the manual page of ssh_config(5). (for the server side, see sshd_config(5))

  • thats an awesome trick! I have seen people do this at my work, and was ashamed to ask :=) thanks. Till now I had .ssh scripts that just had line of command inside them. – user25389 Apr 14 '12 at 19:52
  • 1
    Another advantage of using the ssh config file over scripts with ssh options in it is that commands like sftp and scp also work with it. Consider the case where you need to copy a file quickly. Then it suffices to run scp home:.vimrc ~ to copy .vimrc from your remote home directory in the local home dir. – Lekensteyn Apr 14 '12 at 19:55

Use two private keys

Set up your workstation using the same process (but not the same private key) as you did when you set up your laptop:

  • There is never a good reason to copy a private key from some other machine. If you haven't already generated a fresh private key on your workstation, do so now. Also generate the corresponding public key. In a terminal on your workstation,

type: ssh-keygen -t rsa

  • Copy your workstation's public key to the server. In a terminal on your workstation,

type: ssh-copy-id username@hostname.net

(but use your actual username and hostname, and later type in your password when it asks for it).

This installs the public key of your workstation into the ~/.ssh/authorized_keys file for that user on the server.

  • There is no step 3. From now on, you can log into the server from your workstation, and you never copied your laptop's secret private key from your laptop.


I assume that what you are really asking is

  • I have an Ubuntu server ("home")
  • I log in to my Ubuntu server from my personal laptop ("laptop")
  • I also log in to my Ubuntu server from my work computer ("workstation").

What is the right way to do that?

  • I suppose I could simply log in with the same password from both places. That can't be the right way, because everyone says that public key authentication is much better than passwords. (a)
  • I suppose I could simply copy the private key from my laptop to my workstation. That can't be the right way, because everyone says that the private key is never supposed to leave the client machine.

People have it hammered into their head that one account on a server has a single username and, of course, a single authorized password.

Public-key systems like ssh are better than the password system: One account on a server has a single username and any number of authorized public keys, all of them listed in the ~/.ssh/authorized_keys file.

(more details).


No, at least with the configuration I have if you enable password authentication it will only prompt for the password if you do not have a key.

That being said -- I would never enable password authentication on a server exposed to the Internet.

  • hey, thanks for response. Is it such a big security risk? – user25389 Apr 14 '12 at 19:40
  • Yeah it is. It allows people to brute-force attack the username and password fields. Even if they don't get in, it can cause a whole slew of issues. Fore example, I need to move mine to ssh-based authentication because my hosts.deny file is getting too large, due to using fail2ban to limit the amount of abuse ssh username login gets. – SinaCutie Apr 14 '12 at 19:46
  • Just create a different key pair for your PC @work. That way you can block the key@work separately from your key@home. – jippie Apr 14 '12 at 19:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy