Re: How to authenticate many users with the same public key.

Hi,

Thorvald wrote:
On 28 Wrz, 12:31, Hans van Zijst <h...@xxxxxxxxxxx> wrote:
Hi Thorvald,

Hi Hans,
Thank you for your answer.

It's not impossible per se. You could give your colleagues the same set
of keys, both public and private. I wouldn't recommend it though, why
not give everyone his own key and install their public key on all
servers? You can distribute and maintain those public keys quite easily
with rsync.

I can't give them the same keys as I tried and it didn't work. Don't
know what did I do wrong. I don't want to give everyone his own key as
it will be valid only per person PC. We have to connect via VPN from
homes and we have to have the same key for everybody.

Which client do you use? And what did you do to give the keypair to your colleages? You have to give them both the private and the public key. Plus, of course, the password that protects the private key. Usually, that means copying two files and probably setting the correct permissions on both.

In OpenSSH you'll find your public key in $HOME/.ssh/id_rsa.pub and the matching private key in $HOME/.ssh/id_rsa. I'm not really sure, but I have some recollection that SSH wants the private key to only be readable by the user.



If you want to get rid of maintaing accounts and public keys on all your
servers, I can recommend Active Directory / Kerberos. Configure your
server to use Kerberos and maintain your accounts only there. It does
take a bit of work to set it up, but as soon as it works, you have onle
one place to do your account (and key) maintenance.

I don't want to as we've got some private servers too, so we can't do
it. All servers are virtual and I don't think that would work with AD
or any other AAA. Too much of work for nothing.

I remember that once on one server in my previous company but I did it
like to hold on USB stick a keys, and I had putty prepared to use keys
from USB. I could use these on all servers I had. But now ... simply I
don't remember what to do and how :/.

Using a USB disk is fine. I use an encrypted one (check LUKS for Linux, or FreeOTFE for Windows) because I'm rather paranoid. I created a directory ssh in which I store both my OpenSSH keys (public and private) and those converted to PuTTY format, all in one directory. When I fire up PuTTY, I simply tell it to open a key from that location. If your entire team uses the same directory-layout on your USB disks, you can probably get away with sharing both your session setups and keys.

Check your filesystem, usually you'll find you PuTTY keys somewhere under the PuTTY tree. I remember that PuTTY wants its public keys to have .pub as their extension and .ppk for private keys, but I don't remember what filenames it suggests when generating or exporting keys.



Kind regards,

Hans

Thank you for your answer again.

Regards,
TH

Good luck! Please drop a note if you got things working the way you want them.

Kind regards,

Hans
.

Relevant Pages

  • Re: When to use Public/Private Key & when to gen new one?
    ... The key pair is uniquely bound to each other: you can't have one private key ... options for extracting the public key, but not one for 'build new public key ... I was including in assemblies whatever it had spat one ... probably keep the same snk file across various builds of an assembly, ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: More on learning "Public Key Authentication" [correction]
    ... As the person who created that private ... How do I "specify" the file? ... > transfer the long 2048 digit public key to the other computer. ... specific keyfile you want to use to encrypt or sign a specific data ...
    (comp.sys.mac.system)
  • Re: Encryption question
    ... will be able to encrypt and decrypt the same messange. ... it with alice private key.... ... >>messange with his public nor with is private. ... she will encrypt it with his public key. ...
    (Security-Basics)
  • Re: private to public decrypt now working
    ... If you switch it to use the public key to encrypt and private to decrypt it works. ...
    (microsoft.public.dotnet.security)
  • Re: DNS for trusts between separate private forests accross the In
    ... This is a small installation and it just so happens that one of the servers ... The firewall is set to map a fixed external IP ... into one of the other remote but private domains. ... Or would it be better to use secondary zone ...
    (microsoft.public.windows.server.dns)