The client side needs to generate the key-pairs and the server side needs to have the public keys for each acceptable key-pair added to ~/.ssh/authorized_keys file for the user account on the server being connected to. Never copy the private key between users or servers (except for backups I suppose) because these are the critical identity proof for the client. If misused, you have little idea what has used them. If you feel that the integrity might have been compromised on a client, you can change the public key for just that client on the server rather than on all the clients, which is prone to error from clients being switched off or you not having the rights to sign on to the client to change the keys etc.

The server uses the keys for the requested user in ~/.ssh/authorized_keys in turn to encrypt a challenge to any connecting client. A client can prove it's identity by decrypting the challenge and responding, so keep the private key (used for decryption) separate for each user of each client and you will know what is permitted or not. The server can have multiple public keys authorised for any particular account by adding the multiple public keys on separate lines in ~/.ssh/authorized_keys for the target user(s) that the client is permitted to connect to.

You can go further and the client could generate multiple pairs of keys and save them to different pairs of files. The client can then be directed to use the appropriate private key for each user/server combination it wishes to connect to. Some may think this as overkill but it is an option should you deem it necessary and it is your choice. We use single client key-pairs for many things but specific user/server key-pairs for our most critical connections.

Remember that security is important and SSH (and related services) enforce this. Generally try to ensure that client's ~/.ssh directory and contents must not be readable by anyone else. Open permissions get rejected. Similar for the target account on the server. Openning permissions up to 'help' it will not work.



I hope that this helps,
Robin