You might have AWS create many such key pairs, and distribute one each to multiple parties, but then you as the distributor could have copied each private key, and also you have to transfer the private keys between your machine and the other users' machines. You almost certainly don't want to share the same key pair with multiple people, as this means you would all appear as the same user to the server and it would be impossible to revoke access from just one person. You're quite right that what they're doing is a violation of the usual expectations around private keys! I don't know why AWS isn't following this pattern. This requires some basic SSH skills, of course, but so does using SFTP at all, and it's very unlikely anybody will have access to an sftp client but not to ssh-keygen. The usual approach (as seen on sites like Github) is to allow the user to upload their own public key (either from a key pair generated anew for this purpose, or one they already have around), which the web app then injects into the server's authorized_keys file. In this case, the server already knows the public portion of the key pair you download, but not the private portion, however you need the private key in order to prove ownership of the public key.

It's almost certainly not the server's private key, but rather a user private key that AWS is, for some reason, generating for you.

I can't easily revoke access because I would have to generate a new key pair on a new instance to do that and then share the new private key with all users for which I did not want to revoke access.Ĭan someone explain to me how this method is secure? Or maybe explain what I'm not understanding about how private/public keys work? Is this the appropriate method to give easily revoked SFTP access? If not, what is the appropriate method? I'm not sure I understand how this is a secure way of giving SFTP access to the server if the private key is never supposed to leave the server.

If I want to provide SFTP access to these users I have to give them the server's private key file. The only way to do this is to download the key pair from the AWS account and use that file in the SFTP application (FileZilla in this case). I have a Lightsail instance that I would like to allow others to access using SFTP. My elementary understanding of keys is that the private key should remain on the machine it was generated on and never be shared. I am still learning about SSH, SFTP and private/public keys.

Filezilla ssh lightsail connect