# Scp using public key **URL:** \ **Category:** Deployments\ **Created:** [March 15, 2017, 2:17pm UTC](https://discuss.circleci.com/t/scp-using-public-key/11094 "2017-03-15T14:17:58Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![nfantone](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/nfantone/32/15670_2.png) [@nfantone](https://discuss.circleci.com/u/nfantone)\ **Post date:** [March 15, 2017, 2:17pm UTC](https://discuss.circleci.com/t/scp-using-public-key/11094/1 "2017-03-15T14:17:58Z")
Hi all! I’m new to the community and trying to setup things for a passwordless scp deployment. I am _not_ a sysadmin, but from what I understand traditionally, what I need in order to achieve this, is to configure the **public SSH key** of the server running the `scp` as an `authorized_host` of the destination. So I look at CircleCI settings and it’s asking me for **my private SSH key** (i.e.: where I am deploying to). This is exactly the opposite of how trustability in the crypto world works, as far as I am aware. You are making me copy my **private key** into a web form. By uploading it to CircleCI, I’m effectively giving you permission to access every other server in the world that acknowledges my **public key**. TravisCI, just to give an example, has a mechanism for _encrypting the `id_rsa` file_ and only decrypt it during a build if it’s needed. And that whole process in done via a CLI tool (not a web browser). So how should I go about all this? Any other proposed way I could tackle this without the implications of a potentially severe security breach? Thank you very much. ---
**Author:** ![levlaz](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/levlaz/32/36978_2.png) [@levlaz](https://discuss.circleci.com/u/levlaz)\ **Post date:** [March 15, 2017, 9:28pm UTC](https://discuss.circleci.com/t/scp-using-public-key/11094/2 "2017-03-15T21:28:57Z")
> [@nfantone](#): > > By uploading it to CircleCI, I’m effectively giving you permission to access every other server in the world that acknowledges my public key. You are correct here. I would suggest using a specific key that you generate on the server(s) that you are deploying to rather than using “your” key. We encrypt the data at rest, and the web form is over TLS so there is no significant risk of uploading and using the key this way. What I typically do is: 1. Log into my server that I want CircleCI to deploy to as the user that is going to be doing the deployment (not root). 2. Run `ssh-keygen` 3. Copy `~/.ssh/id_rsa` to the CircleCI web form 4. Copy `~/.ssh/id_rsa.pub` to `authorized_keys` Best, Lev ---
**Author:** ![fonzarely](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/fonzarely/32/15691_2.png) [@fonzarely](https://discuss.circleci.com/u/fonzarely)\ **Post date:** [March 17, 2017, 4:55pm UTC](https://discuss.circleci.com/t/scp-using-public-key/11094/3 "2017-03-17T16:55:27Z")
Hi, Did the scp copy works after that ? In my setup the scp request I accept the remote host but I cannot ssh to the circle ci 2 instance to accept the remote server. =\> Are you sure you want to continue connecting (yes/no)? I added the ‘Installing additional ssh keys’ run step, What did I miss in the configuration ? ---
**Author:** ![FelicianoTech](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/felicianotech/32/21348_2.png) [@FelicianoTech](https://discuss.circleci.com/u/FelicianoTech)\ **Post date:** [March 17, 2017, 7:11pm UTC](https://discuss.circleci.com/t/scp-using-public-key/11094/4 "2017-03-17T19:11:37Z")
I’m not 100% clear on what you said but… As Lev mentioned, you want to create a new key pair. The private key, you upload to CircleCI, via our website, in the project’s setting page. The public key, you append it to the `authorized_keys` file on the server you are trying to deploy to. Keep in mind that the username needs to be correct as well. Ever system user on the remote server has its own `authorized_keys` file so make sure you specify the correct one. ---
**Author:** ![fonzarely](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/fonzarely/32/15691_2.png) [@fonzarely](https://discuss.circleci.com/u/fonzarely)\ **Post date:** [March 17, 2017, 8:28pm UTC](https://discuss.circleci.com/t/scp-using-public-key/11094/5 "2017-03-17T20:28:26Z")
I managed the key pair deployment on CI and my server. My issue is that I cannot make ssh/scp to accept the key fingerprint. I’ve found a workaround but it feel not best secure: ``` - add_ssh_keys - deploy: command: | if ["${CIRCLE_BRANCH}" == "circle_2_deploy"]; then scp -oStrictHostKeyChecking=no -r /home/ubuntu/mdph/dist/. ${DEPLOY_USER}@${DEPLOY_SERVER}:${DEPLOY_DIR}/. fi ``` What do you think of it ? ---
**Author:** ![nfantone](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/nfantone/32/15670_2.png) [@nfantone](https://discuss.circleci.com/u/nfantone)\ **Post date:** [March 17, 2017, 9:49pm UTC](https://discuss.circleci.com/t/scp-using-public-key/11094/6 "2017-03-17T21:49:09Z")
> [@levlaz](#): > > I would suggest using a specific key that you generate on the server(s) that you are deploying to rather than using “your” key. That goes without saying. > [@levlaz](#): > > We encrypt the data at rest, and the web form is over TLS so there is no significant risk of uploading and using the key this way. From the moment I press Ctrl/Cmd+C on my private key, the risked ceased to be zero (I’m assuming my own private server is reasonably secure or secure enough _for me_, under my responsibility). I’m sure you don’t have any intrinsically bad intentions (though I only have your word for it) - but you can’t offer any guarantee that any other third party out there doesn’t. Now or in the future. > [@FelicianoTech](#): > > I’m not 100% clear on what you said but… I guess what I’m trying to say is that asymmetric cryptography in general is a perfectly clear mechanism that works well enough as long as we all abide to certain rules: rules that you are openly breaking. Or encouraging people to break. If he is to contact Alice, Bob needs to know her **public key**. Private keys should _never be shared_ under any circumstance - unless, of course, [the man with the wrench comes along](https://xkcd.com/538/). ---
**Author:** ![FelicianoTech](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/felicianotech/32/21348_2.png) [@FelicianoTech](https://discuss.circleci.com/u/FelicianoTech)\ **Post date:** [March 18, 2017, 12:10am UTC](https://discuss.circleci.com/t/scp-using-public-key/11094/7 "2017-03-18T00:10:03Z")
You can add the public key indicated by the fingerprint like this: ```auto - add_ssh_keys - deploy: command: | if ["${CIRCLE_BRANCH}" == "circle_2_deploy"]; then echo ' ' >> ~/.ssh/known_hosts scp -oStrictHostKeyChecking=no -r /home/ubuntu/mdph/dist/. ${DEPLOY_USER}@${DEPLOY_SERVER}:${DEPLOY_DIR}/. fi ``` By your example, `hostname` would be `${DEPLOY_SERVER}`, `type` is the type of SSH key (ssh-rsa, ecdsa-sha2-nistp256, etc), and `key` is the public key of `hostname`. ---
**Author:** ![nfantone](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/nfantone/32/15670_2.png) [@nfantone](https://discuss.circleci.com/u/nfantone)\ **Post date:** [March 18, 2017, 12:01pm UTC](https://discuss.circleci.com/t/scp-using-public-key/11094/8 "2017-03-18T12:01:11Z")
Now, this is more like it. I wasn’t aware of the `add_ssh_keys` step. In my humble opinion, this should really be the de facto way of managing scenarios like this. But some official [replies](https://discuss.circleci.com/t/deploying-to-generic-server-with-ssh-et-al/4097/7?u=nfantone) and [documents](https://circleci.com/docs/1.0/permissions-and-access-during-deployment/) are sadly pointing the other way. Thank you very much, @FelicianoTech. ---
**Author:** ![system](https://global.discourse-cdn.com/circleci/original/3X/5/1/511608acda8e85906e15909b57bd0a46c1dbe291.png) [@system](https://discuss.circleci.com/u/system)\ **Post date:** [June 18, 2018, 11:41am UTC](https://discuss.circleci.com/t/scp-using-public-key/11094/9 "2018-06-18T11:41:14Z")