Linux – use SSH key authentication to log into a remote system with a different username

authenticationlinuxsolarisssh

Suppose I have a remote system named "remotesystem", and a user account "foouser" on that system.

I know that on my local system, I can generate an SSH key pair as local user "foouser", put the public key in the "/home/foouser/.ssh/authorized_keys" file on "remotesystem". When I SSH as "foouser" from my local system to "remotesystem", SSH uses the key pair to authenticate me.

But what if my local username is not the same as the username on the remote system? That is, what if I want to SSH as local user "baruser" to "remotesystem"? Obviously, I will need to generate a key pair for "baruser" and add the public key to "/home/foouser/.ssh/authorized_keys". Then, I should be able to "ssh foouser@remotesystem" while logged in as "baruser" locally, and SSH will use the key pair to authenticate, right?

I'm asking because I am trying to get the key authentication working in this scenario, without success. I'm not sure if its due to the username mismatch, or a configuration issue with the SSH server on the remote system.

Best Answer

Yes, you can do this, just as you described it.

baruser@here ~$ ssh-add -l
4096 10:b3:fd:29:08:86:24:a6:da:0a:dd:c6:1e:b0:66:6a id_rsa (RSA)
baruser@here ~$ ssh foouser@remotesystem
motd message, etc.
foouser@remotesystem ~$

Related Solutions

SSH Public Key Authentication – Using One Key for Multiple Users

First, there's no security benefit to only allowing users to connect with a username of "developer". If you want users to have shared access to the same group of files, put them in the same UNIX group and have /var/Tasks be owned by that group. Seperate usernames allow for auditing, better troubleshooting, etc.

As for your other questions:

Client usernames are not important. When connecting, users can specific which remote username they want to use: ssh username@example.com
You can populate authorized_keys with as many user keys as you have diskspace for, and you can do it before the server is deployed. Also, the same authorized_keys file is read regardless of which portnumber sshd is listening on.
Yes, the server's public key will be stored in known_hosts and first time connections will prompt the user to accept the remote key. This part is what makes SSH able to detect man-in-the-middle attacks, and if users just blindly accept any key, SSH becomes vulnerable to man-in-the-middle attacks. If you have sufficient access to the client machines, you can add the remote servers key fingerprint to each client's known_hosts. That's the only way you can avoid this prompt.
You can use the AuthorizedKeysFile keyword in sshd_config to specify where you want sshd to look for keys on the server. I put keys in /etc/ssh/keys/%u where %u is a file with the users name and I make sure the user only has read-access.

Linux – ssh-keygen works for root only

Check permissions on the remote system:

$ chmod 700 ~/.ssh
$ chmod 600 ~/.ssh/authorized_keys

There is a tool that could be installed in your dist (ubuntu/debian has it) called: ssh-copy-id which will do this for you:

$ ssh-copy-id <remote>

If that doesn't work try ssh with option "-v" to see more verbose messages.

Long version:

#From client to server
client$ scp ~/.ssh/id_rsa.pub remote_server.org:

# next, setup the public key on server
server$ mkdir ~/.ssh
server$ chmod 700 ~/.ssh
server$ cat ~/id_rsa.pub >> ~/.ssh/authorized_keys
server$ chmod 600 ~/.ssh/authorized_keys
server$ rm ~/id_rsa.pub

Related Topic