ssh-copy-id without authentication
Clash Royale CLAN TAG#URR8PPP up vote
0
down vote
favorite
How does Linux server allow anyone to copy the string (public key) using ssh-copy-id without authentication? Doesn't it allow the unknown user to copy any malicious file onto the server?
ssh security
asked Feb 25 at 17:28
Prem
1053
add a comment |Â
up vote
0
down vote
favorite
How does Linux server allow anyone to copy the string (public key) using ssh-copy-id without authentication? Doesn't it allow the unknown user to copy any malicious file onto the server?
ssh security
asked Feb 25 at 17:28
Prem
1053
5
What gave you that impression?ssh-copy-idjust automates the commandsscp .ssh/id_rsa.pub user@other-host; ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys, i.e. it's just a convenience script. It does require authentication.
– PerlDuck
Feb 25 at 17:33
@PerlDuck So, can anyone who knows the server's public ip create public key and copy that onto the server ?
– Prem
Feb 25 at 17:39
1
@Prem No. You need the password ofuser@other-hostto add the public key touser@other-host's authorized_keys file. Believe me:ssh-copy-iddoesn't do anything else thanscpandsshon your behalf.
– PerlDuck
Feb 25 at 17:43
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
How does Linux server allow anyone to copy the string (public key) using ssh-copy-id without authentication? Doesn't it allow the unknown user to copy any malicious file onto the server?
ssh security
asked Feb 25 at 17:28
Prem
1053
How does Linux server allow anyone to copy the string (public key) using ssh-copy-id without authentication? Doesn't it allow the unknown user to copy any malicious file onto the server?
ssh security
ssh security
asked Feb 25 at 17:28
Prem
1053
asked Feb 25 at 17:28
Prem
1053
asked Feb 25 at 17:28
Prem
1053
asked Feb 25 at 17:28
Prem
1053
asked Feb 25 at 17:28
Prem
1053
1053
5
What gave you that impression?ssh-copy-idjust automates the commandsscp .ssh/id_rsa.pub user@other-host; ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys, i.e. it's just a convenience script. It does require authentication.
– PerlDuck
Feb 25 at 17:33
@PerlDuck So, can anyone who knows the server's public ip create public key and copy that onto the server ?
– Prem
Feb 25 at 17:39
1
@Prem No. You need the password ofuser@other-hostto add the public key touser@other-host's authorized_keys file. Believe me:ssh-copy-iddoesn't do anything else thanscpandsshon your behalf.
– PerlDuck
Feb 25 at 17:43
add a comment |Â
5
What gave you that impression?ssh-copy-idjust automates the commandsscp .ssh/id_rsa.pub user@other-host; ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys, i.e. it's just a convenience script. It does require authentication.
– PerlDuck
Feb 25 at 17:33
@PerlDuck So, can anyone who knows the server's public ip create public key and copy that onto the server ?
– Prem
Feb 25 at 17:39
1
@Prem No. You need the password ofuser@other-hostto add the public key touser@other-host's authorized_keys file. Believe me:ssh-copy-iddoesn't do anything else thanscpandsshon your behalf.
– PerlDuck
Feb 25 at 17:43
5
5
What gave you that impression?
ssh-copy-id just automates the commands scp .ssh/id_rsa.pub user@other-host; ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys, i.e. it's just a convenience script. It does require authentication.– PerlDuck
Feb 25 at 17:33
What gave you that impression?
ssh-copy-id just automates the commands scp .ssh/id_rsa.pub user@other-host; ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys, i.e. it's just a convenience script. It does require authentication.– PerlDuck
Feb 25 at 17:33
@PerlDuck So, can anyone who knows the server's public ip create public key and copy that onto the server ?
– Prem
Feb 25 at 17:39
@PerlDuck So, can anyone who knows the server's public ip create public key and copy that onto the server ?
– Prem
Feb 25 at 17:39
1
1
@Prem No. You need the password of
user@other-host to add the public key to user@other-host's authorized_keys file. Believe me: ssh-copy-id doesn't do anything else than scp and ssh on your behalf.– PerlDuck
Feb 25 at 17:43
@Prem No. You need the password of
user@other-host to add the public key to user@other-host's authorized_keys file. Believe me: ssh-copy-id doesn't do anything else than scp and ssh on your behalf.– PerlDuck
Feb 25 at 17:43
add a comment |Â
2 Answers
2
active
oldest
votes
up vote
4
down vote
accepted
ssh-copy-id just automates the commands
scp .ssh/id_rsa.pub user@other-host:
ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys'
ssh user@other-host 'rm id_rsa.pub'
That is: it copies your local id_rsa.pub file to the other server and appends it to the remote user's authorized_keys file.
It is just a convenience script and it requires authentication. You have to supply user's password (at other-host) for it to work. ssh-copy-id doesn't do anything else than scp and ssh on your behalf so if they require password authentication, ssh-copy-id will do so as well.
answered Feb 25 at 17:40
PerlDuck
4,03311030
add a comment |Â
up vote
2
down vote
If they don't know the password, they can't copy the id into the server so don't turn off PasswordAuthentication.
Match User user1,user2,user3
PasswordAuthentication yes
Edit :
If you allow login without auth, they don't even need to copy-id their key, since they can login anyway without the key, IF they know the username..
edited Feb 25 at 17:42
pa4080
12.3k52256
answered Feb 25 at 17:37
An0n
80418
And if they know the password ?
– An0n
Apr 12 at 20:33
add a comment |Â
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
4
down vote
accepted
ssh-copy-id just automates the commands
scp .ssh/id_rsa.pub user@other-host:
ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys'
ssh user@other-host 'rm id_rsa.pub'
That is: it copies your local id_rsa.pub file to the other server and appends it to the remote user's authorized_keys file.
It is just a convenience script and it requires authentication. You have to supply user's password (at other-host) for it to work. ssh-copy-id doesn't do anything else than scp and ssh on your behalf so if they require password authentication, ssh-copy-id will do so as well.
answered Feb 25 at 17:40
PerlDuck
4,03311030
add a comment |Â
up vote
4
down vote
accepted
ssh-copy-id just automates the commands
scp .ssh/id_rsa.pub user@other-host:
ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys'
ssh user@other-host 'rm id_rsa.pub'
That is: it copies your local id_rsa.pub file to the other server and appends it to the remote user's authorized_keys file.
It is just a convenience script and it requires authentication. You have to supply user's password (at other-host) for it to work. ssh-copy-id doesn't do anything else than scp and ssh on your behalf so if they require password authentication, ssh-copy-id will do so as well.
answered Feb 25 at 17:40
PerlDuck
4,03311030
add a comment |Â
up vote
4
down vote
accepted
up vote
4
down vote
accepted
ssh-copy-id just automates the commands
scp .ssh/id_rsa.pub user@other-host:
ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys'
ssh user@other-host 'rm id_rsa.pub'
That is: it copies your local id_rsa.pub file to the other server and appends it to the remote user's authorized_keys file.
It is just a convenience script and it requires authentication. You have to supply user's password (at other-host) for it to work. ssh-copy-id doesn't do anything else than scp and ssh on your behalf so if they require password authentication, ssh-copy-id will do so as well.
answered Feb 25 at 17:40
PerlDuck
4,03311030
ssh-copy-id just automates the commands
scp .ssh/id_rsa.pub user@other-host:
ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys'
ssh user@other-host 'rm id_rsa.pub'
That is: it copies your local id_rsa.pub file to the other server and appends it to the remote user's authorized_keys file.
It is just a convenience script and it requires authentication. You have to supply user's password (at other-host) for it to work. ssh-copy-id doesn't do anything else than scp and ssh on your behalf so if they require password authentication, ssh-copy-id will do so as well.
answered Feb 25 at 17:40
PerlDuck
4,03311030
edited Feb 25 at 17:46
answered Feb 25 at 17:40
PerlDuck
4,03311030
answered Feb 25 at 17:40
PerlDuck
4,03311030
answered Feb 25 at 17:40
PerlDuck
4,03311030
4,03311030
add a comment |Â
add a comment |Â
up vote
2
down vote
If they don't know the password, they can't copy the id into the server so don't turn off PasswordAuthentication.
Match User user1,user2,user3
PasswordAuthentication yes
Edit :
If you allow login without auth, they don't even need to copy-id their key, since they can login anyway without the key, IF they know the username..
edited Feb 25 at 17:42
pa4080
12.3k52256
answered Feb 25 at 17:37
An0n
80418
And if they know the password ?
– An0n
Apr 12 at 20:33
add a comment |Â
up vote
2
down vote
If they don't know the password, they can't copy the id into the server so don't turn off PasswordAuthentication.
Match User user1,user2,user3
PasswordAuthentication yes
Edit :
If you allow login without auth, they don't even need to copy-id their key, since they can login anyway without the key, IF they know the username..
edited Feb 25 at 17:42
pa4080
12.3k52256
answered Feb 25 at 17:37
An0n
80418
And if they know the password ?
– An0n
Apr 12 at 20:33
add a comment |Â
up vote
2
down vote
up vote
2
down vote
If they don't know the password, they can't copy the id into the server so don't turn off PasswordAuthentication.
Match User user1,user2,user3
PasswordAuthentication yes
Edit :
If you allow login without auth, they don't even need to copy-id their key, since they can login anyway without the key, IF they know the username..
edited Feb 25 at 17:42
pa4080
12.3k52256
answered Feb 25 at 17:37
An0n
80418
If they don't know the password, they can't copy the id into the server so don't turn off PasswordAuthentication.
Match User user1,user2,user3
PasswordAuthentication yes
Edit :
If you allow login without auth, they don't even need to copy-id their key, since they can login anyway without the key, IF they know the username..
edited Feb 25 at 17:42
pa4080
12.3k52256
answered Feb 25 at 17:37
An0n
80418
edited Feb 25 at 17:42
pa4080
12.3k52256
edited Feb 25 at 17:42
pa4080
12.3k52256
edited Feb 25 at 17:42
pa4080
12.3k52256
12.3k52256
answered Feb 25 at 17:37
An0n
80418
answered Feb 25 at 17:37
An0n
80418
answered Feb 25 at 17:37
An0n
80418
80418
And if they know the password ?
– An0n
Apr 12 at 20:33
add a comment |Â
And if they know the password ?
– An0n
Apr 12 at 20:33
And if they know the password ?
– An0n
Apr 12 at 20:33
And if they know the password ?
– An0n
Apr 12 at 20:33
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1009683%2fssh-copy-id-without-authentication%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
5
What gave you that impression?
ssh-copy-idjust automates the commandsscp .ssh/id_rsa.pub user@other-host; ssh user@other-host 'cat id_rsa.pub >> .ssh/authorized_keys, i.e. it's just a convenience script. It does require authentication.– PerlDuck
Feb 25 at 17:33
@PerlDuck So, can anyone who knows the server's public ip create public key and copy that onto the server ?
– Prem
Feb 25 at 17:39
1
@Prem No. You need the password of
user@other-hostto add the public key touser@other-host's authorized_keys file. Believe me:ssh-copy-iddoesn't do anything else thanscpandsshon your behalf.– PerlDuck
Feb 25 at 17:43