How do I allow multiple people to connect using SSH?

This page is showing a generic answer.
To see a more detailed answer customized for you, type your domain name here:

Our instructions for using SSH to make shell connections explain how to connect using your master account password.

It’s also possible to connect using a different method, called SSH keys. Using keys has a big advantage over using a single password: multiple people can each have their own key, so you don’t need to share passwords at all. And if you have multiple domain names hosted with us, each domain name can have its own keys, even if they’re grouped under a single master password.

SSH keys can also be used to provide key-based secure SFTP access to multiple users.

Generating keys

To use SSH keys, you first need to “generate” them on your own computer. Each person who will connect should have their own key.

While we don't have detailed instructions explaining how to generate a key on this page, here are third-party pages that explain the process:

We strongly recommend protecting each key with its own passphrase (which can be completely different from any password you have with our company).

Installing keys with ssh-copy-id

Once you've generated the key, you’ll need to add the “public key” part to your account with us. If you’re on a Mac or Linux computer, an easy and safe method is to use the “ssh-copy-id” command on your own computer: 

ssh-copy-id example.com@example.com

(You’ll still need to use your master password to login for this initial shell connection, of course.)

If you generated the key on a Windows computer, or you want to manually add it to the server without using ssh-copy-id for another reason, you can edit the “authorized_keys” file on the server after you make an initial shell connection using your account password. Just run this: 

editor ~/.ssh/authorized_keys

... and add the public key as a new link to that file.

(You would also need to use this method to add a key if someone who doesn’t know the master account password generated their own key, then sent you the public portion of it to be added to the server’s “authorized_keys” file.)

That’s all it takes. Once you’ve done this, following our SSH connection instructions from a computer that has the key will no longer require a password — but will still be completely secure because nobody else knows the “private” part of the key that‘s stored on your own computer. That key uses much stronger encryption than a password, and is additionally protected by a local passphrase on your computer if you followed our recommendation above.

Other advantages of using SSH keys

Using SSH keys has other advantages beyond “you don’t need to share passwords”. For example, you can restrict certain keys so that they can only login from certain IP addresses, like this example that allows connections only from IP addresses beginning with “192.0.2.”: 

from="192.0.2.0/24" ssh-rsa AA...8F address@example.com

This example allows connections only from IP addresses with reverse DNS ending with “comcast.net”: 

from="*.comcast.net" ssh-rsa AA...8F address@example.com

And this allows connections from any IP addresses except ones with reverse DNS entries ending in “.cn” or “.ru”: 

from="*,!*.cn,!*.ru" ssh-rsa AA...8F address@example.com

There are many other options available, described on the authorized_keys man page.

Copyright © 2000-2024 Tiger Technologies LLC