Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

ssh-copy-id

Install your public SSH key on a server, so you can log in with the key instead of a password.

Level
RHCSA exam
Group
SSH and remote work
Needs root
No
Package
openssh-clients

What it does

ssh-copy-id logs in to the server (with your password, one last time), adds your public key to ~/.ssh/authorized_keys of the remote user, and sets the right permissions on ~/.ssh and the file. It does not add a key twice.

By default it uses all your keys (or the ones in ssh-agent). With -i you choose one key.

How to write it

ssh-copy-id [-f] [-n] [-s] [-x] [-i [IDENTITY_FILE]] [-t TARGET_PATH] [-p PORT] [-o SSH_OPTION] [USER@]HOST

Options 9

Most used

-i file
Install this public key (like ~/.ssh/id_ed25519.pub).
-p port
The SSH port of the server.
-o option
Pass an option to ssh (like -o ProxyJump=bastion).
-n
Dry run: show which keys would be installed, change nothing.
-f
Force: install the key even if it seems to be there already, and do not test the login.
-s
Use SFTP to install the keys (for servers that allow only SFTP).
-t path
Install into this file instead of ~/.ssh/authorized_keys.
-x
Debug output.
-h, -?
Show the usage.

Examples 11

$ run as a normal user# run as root (or with sudo)

  1. 1Install your key on a server

    ssh-copy-id student@server2

    Asks for the password of student on server2. Next logins use the key.

  2. 2Install one specific key

    ssh-copy-id -i ~/.ssh/deploy_ed25519.pub deploy@web01

    Only this key is added.

  3. 3Use another port

    ssh-copy-id -p 2222 admin@bastion.example.com

    Same -p as ssh.

  4. 4See which keys would be copied

    ssh-copy-id -n student@server2

    A dry run.

  5. 5Copy a key through a jump host

    ssh-copy-id -o ProxyJump=admin@bastion.example.com admin@10.10.0.15

    Works for servers in a private network.

  6. 6Test right after copying

    ssh-copy-id student@server2 && ssh -o BatchMode=yes student@server2 true && echo "key login works"

    BatchMode fails instead of asking for a password, so the test is honest.

  7. 7Install keys for root (when root login with password is still allowed)

    ssh-copy-id root@server2

    Then disable password login for root in sshd_config (chapter 20).

  8. 8Copy the key of an automation account

    sudo -u ansible ssh-copy-id -i /home/ansible/.ssh/id_ed25519.pub ansible@web01

    The key of the ansible user, installed for ansible on web01.

  9. 9Install the key into a custom file

    ssh-copy-id -t /home/student/.ssh/authorized_keys2 student@server2

    For servers with a special AuthorizedKeysFile setting.

  10. 10Use SFTP mode on a restricted server

    ssh-copy-id -s sftpuser@files.example.com

    When the account has no shell.

  11. 11Do it by hand when ssh-copy-id is missing

    cat ~/.ssh/id_ed25519.pub | ssh student@server2 'mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

    What ssh-copy-id does for you.

Watch out

  • The server must allow password login for this first copy (or you add the key another way).
  • Wrong permissions on the remote ~ (group-writable), ~/.ssh or authorized_keys make sshd ignore the key.

Tips to remember

  • One time: ssh-copy-id user@host. Forever: ssh user@host without password.