Ubuntu – Multiple SSH private keys for the same host

githubsshUbuntu

How can I store 2 different private SSH keys for the same host? I have tried 2 entries in /etc/ssh/ssh_config for the same host with the different keys, and I've also tried to put both keys in the same file and referencing it from one hosts setting, however both do not work.

More detail: I'm running Ubuntu server (12.04) and I want to connect to GitHub via SSH to download the latest source for my projects. There are multiple projects running on the same server and each project has a GitHub repo with it's own unique deloyment key-pair. So the host is always the same (github.com) but the keys need to be different depending on which repo I'm using.

Different /etc/ssh/ssh_config versions I have tried:

Host github.com
    IdentityFile /etc/ssh/my_project_1_github_deploy_key
    StrictHostKeyChecking no
Host github.com
    IdentityFile /etc/ssh/my_project_2_github_deploy_key
    StrictHostKeyChecking no

and this with both keys in the same file:

Host github.com
    IdentityFile /etc/ssh/my_project_github_deploy_keys
    StrictHostKeyChecking no

I've had no luck with either. Any help would be greatly appreciated!

Best Answer

I would do it like this:

Host project_1
    HostName github.com
    IdentityFile /etc/ssh/my_project_1_github_deploy_key

Host project_2
    HostName github.com
    IdentityFile /etc/ssh/my_project_2_github_deploy_key

and then use project_1 or project_2 as the host to access the repository.

Related Solutions

Linux – Using Same SSH Private Key Across Multiple Machines

The same SSH key should be able to be used from multiple clients. I have different SSH keys for different networks and they're actually stored on an encrypted USB drive that I use from several different computers without a problem.

SSH is very picky about file permissions so I would first check all the permissions from /home/{user} all the way down to the id_rsa file itself.

SSH does not really care for group or world write permissions so make sure you chmod go-w your home directory and the ~/.ssh directory for starters. I'd also make sure they're owned by your user chown ${USER}:${USER}.

For the SSH key itself I chmod 600 them...

If you want I've have additional info on how I manage my SSH keys in my answer to another SSH question.

SSH – How to Securely Add a Host to the Known_hosts File

The most important part of "securely" adding a key to the known_hosts file is to get the key fingerprint from the server administrator. The key fingerprint should look something like this:

2048 SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8 github.com (RSA)

In the case of GitHub, normally we can't talk directly to an administrator. However, they put the key on their web pages so we can recover the information from there.

Manual key installation

1) Take a copy of the key from the server and get its fingerprint. N.B.: Do this before checking the fingerprint.

$ ssh-keyscan -t rsa github.com | tee github-key-temp | ssh-keygen -lf -
# github.com:22 SSH-2.0-babeld-f3847d63
2048 SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8 github.com (RSA)

2) Get a copy of the key fingerprint from the server administrator - in this case navigate to the page with the information on github.com

Go to github.com
Go to the help page (on the menu on the right if logged in; at the bottom of the homepage otherwise).
In the Getting Started section go to Connecting to GitHub with SSH
Go to Testing your SSH connection
Copy the SHA256 fingerprint from that page into your text editor for later use.

3) Compare the keys from the two sources

By placing them directly one above the other in a text editor, it is easy to see if something has changed

2048 SHA256:nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8 github.com (RSA) #key recovered from github website
2048 SHA256:nThbg6kXUpJ3Gl7E1InsaspRomtxdcArLviKaEsTGY8 github.com (RSA) #key recovered with keyscan

(Note that the second key has been manipulated, but it looks quite similar to the original - if something like this happens you are under serious attack and should contact a trusted security expert.)

If the keys are different abort the procedure and get in touch with a security expert

4) If the keys compare correctly then you should install the key you already downloaded

cat github-key-temp >> ~/.ssh/known_hosts

Or to install for all users on a system (as root):

cat github-key-temp >> /etc/ssh/ssh_known_hosts

Automated key installation

If you need to add a key during a build process then you should follow steps 1-3 of the manual process above.

Having done that, examine the contents of your github-key-temp file and make a script to add those contents to your known hosts file.

if ! grep github.com ~/.ssh/known_hosts > /dev/null
then
     echo "github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==" >> ~/.ssh/known_hosts
fi

You should now get rid of any ssh commands which have StrictHostKeyChecking disabled.