I'm currently following a small game to get more familar with linux and security and got the following task:
The password for the next level is stored in /etc/bandit_pass/bandit14 and can only be read by user bandit14. For this level, you don’t get the next password, but you get a private SSH key that can be used to log into the next level. \ Note: localhost is a hostname that refers to the machine you are working on
For now I'm logged in with the user bandit13 in the machine where user bandit14 exists and got the private key. When executing the ssh -i command on the machine (as logged in user bandit13) I get access to the bandit14 profile:
ssh bandit14@server.org -i privatekeyfile
Now what bothers me is, can one log into your user account by just using the given SSH private key from any remote client? I tried to log in using my system but however, the server refused my key. I tried with PuTTY on windows and with the terminal on Mac OS X (with the same command). From what I know is, that the associated public key needs to be put into the authorized_keys
file at the server (i.e. the machine that get's accessed). But why does logging in from the remote machine not work but from the local one?
Note: The public key is unknown, I got no access to the authorized_keys
file on the server.
ssh-keygen -yf privatekeyfile
.