0

I have an OpenSSH server running and different users can log into it with different privileges.

I know you can enable public key authentication and place all the allowed public keys in the authorized_keys file. But that only restricts which hosts can log in.

I would like to configure public key authentication so that logging in as user1 would require a different key compared to logging in as user2.

Is there a way to achieve this using OpenSSH?

Improve this question
4
  • 2
    I think you're a bit confused about public key authentication. Each user on the server has their own authorized_keys file, so by adding a public key to one user, you allow someone with the corresponding private key to log in, as that user. Therefore if you add a public key to user1's authorized_keys file, but not to user2's, the holder of the corresponding private key will only be able to log in as user1 using it.
    – Matthew
    Jun 17, 2016 at 10:12
  • that is true if you have one sshd process running for each user, but if you have only one running? you only have one authorized_keys file. Or am I missing something?
    – Pandrei
    Jun 17, 2016 at 10:42
  • 2
    Each user account on the destination machine has their own ~/.ssh/authorized_keys (doesn't necessarily have to have, it might not exist). One sshd serves many users.
    – techraf
    Jun 17, 2016 at 10:47
  • Maybe it is not completely clear that the ~ in the path ~/.ssh/authorized_keys stands for /home/username/.
    – John Stoneman
    Mar 8, 2021 at 12:30

1 Answer 1

Reset to default
5

SSH actually requires you to configure different keys for different users.

Each user account on the destination machine has its own ~/.ssh/authorized_keys (doesn't necessarily have to have, it might not exist).

Let's assume you have server and client.

server has users set up as follows:

/home/srv_user01
                /.ssh/authorized_keys
                        --> contains public key of cli_user01
                                 and public key of cli_user03
/home/srv_user02
                /.ssh/authorized_keys
                        --> empty or non-existing
/home/srv_user03
                /.ssh/authorized_keys
                        --> contains public key of cli_user03

client has three accounts cli_user01, cli_user02, and cli_user03.

On client machine:

  • cli_user01 can execute ssh srv_user01@server and login to server as srv_user01
  • cli_user02 cannot connect to server at all
  • cli_user03 can execute:
    • ssh srv_user01@server and login to server as srv_user01, or
    • ssh srv_user03@server and login to server as srv_user03
  • no user can connect and login as srv_user02 on server

In the example above I used different names on client and server side, but if account name was the same on client and server, user doesn't have to specify the account name in ssh command, thus making the impression of "logging to server". So if I am logged on as user on client and execute ssh serverーit is the same as ssh user@server.

On server one sshd process listens on port 22 (default) and receives connections from each of the connecting users.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .