I'm currently following a small game to get more familiar with Linux and security and got the following task:

The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level.

Note: localhost is a hostname that refers to the machine you are working on

For now I'm logged in with the user bandit13 in the machine where user bandit14 exists and got the private key. When executing the ssh -i command on the machine, logged in as bandit13, I get access to the bandit14 profile:

ssh [email protected] -i privatekeyfile

Now what bothers me is this: Can one log into your user account by just using the given SSH private key from any remote client? I tried to log in using my system, but the server refused my key. I tried using PuTTY on Windows and the terminal on Mac OS X with the same command. From what I know, the associated public key needs to be put into the authorized_keys file at the server (i.e. the machine that gets accessed). But why does logging in from the remote machine not work but from the local one?

Note: The public key is unknown. I have no access to the authorized_keys file on the server.

  • 4
    You can extract the SSH public key from a private key file by running ssh-keygen -yf privatekeyfile. Commented Aug 8, 2014 at 12:19

2 Answers 2


Now as I understand this a game, certain liberties might have been take. I could be wrong is it possible that the game did the following:

  1. Installed the public key in authorized_keys
  2. The private key isn't encrypted, not requiring a password
  3. Restricted access by IP, so only local clients could connect.

Pretty contrived (it is a game after all), and no one would really do this... but it would fit the scenario.

  • They surely did install the public key in the authorized_keys file. The private key is indeed not requiring a password. However, this is not really a difference when connection remotely. The third one makes sense but is this even possible? May one restrict the usage of private key files by IP? Since I can connect with any user to the server remotely, the port is open. I don't know any other possibilities to do that. Anyways, thanks for answering, at least one did. :)
    – 0x8BADF00D
    Commented Jul 26, 2014 at 17:21
  • 2
    Seems possible, blog.tinned-software.net/…
    – RoraΖ
    Commented Jul 27, 2014 at 14:58

Hopefully you must have solved that task by now, if not then try :

ssh bandit14@localhost -i privatekey_file

  • This is not what I was asking. I wrote about connecting remotely, i.e. not from the local machine.
    – 0x8BADF00D
    Commented Aug 8, 2014 at 12:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .