Hi!

I have been using SSH for a long time, and I do know the purpose of ssh-copy-id command.

If I copy the pubfile contents and paste it into the authorised_keys file on the target server, that's OK, because I already have access to the target server, and there are not security concerns.

However, I have a silly doubt regarding how ssh-copy-id command works.

Whenever we issue ssh-copy-id -i <pubfile> user@host, we are adding the pubfile contents to authorised_keys file of the ./ssh directory of "user" on "host" machine. But we don't necessary have access to that server yet.

Why can anyone issue that command from anywhere without being asked anything? I mean... anyone could add an arbitrary public key and gain access to any server. Who or which mechanism controls that?

Sorry if that's an obvious question, but I can't find the clue.

Thanks!

if you don't have access to the server you won't be able to add pubfile to authorised_keys. That is that simple.

In other words to copy the keys with ssh-copy-id you still need to be able to login to that server with a valid username and password. It is basically a script that uses the ssh command.

In addition to the above comments, you can look at the contents of ssh-copy-id itself, it's just a simple shell script.

You can copy the keys by hand too, either via password or out of band though out of band is a lot more difficult and time consuming.

OK. I'm beginning to get it.

So, which user should I use to issue ssh-copy-id?
So far I'm trying it with a sudo user which exists on my local machine, but not in the remote server.

Should my local user exist on the remote one?

Thanks!

There are two users involved, the local user which has an id and the remotes user. You need to use the local user to copy that id to the remote host using that remote user.

OK. Here's what I do:

LOCAL:
EDIT: solved

PasswordAuthentication yes
MaxAuthTries 100

I got rid of the message, was prompted for the password and now able to add the pubkey

Thanks everyone!