How does SSH public key auth link a public key to a login?

Question

I've generated a pair of keys with PuttyGen and I use it to connect to a remote server with Putty and SSH.

What surprises me is that, when configuring the public key authentication, at no moment I had to provide a login. The only moment I had to do that is when I had to log in the server to update the file .ssh/authorized_keys. But that log-in could have been done with any user that has the right to update that file.

I've checked the content of the public/private keys and the file authorized_keys, I've seen no info about the login.

When I log in, the login is asked then directly the server seems to look for a public key linked to that login. Where does it look for that link ?

Answer 1

The "public key - login" link is inferred from the place where the public key is stored: it is added to the .ssh/authorized_keys on the server inside a specific user's home directory.

In a typical use case each account has a separate authorized_keys file. If it doesn't exist, you cannot connect to that account with an SSH key-based authorisation.

SSH client provides the account name you want to login to (on Unix-based systems the ssh command executed without account name will request login to the account name currently used on the connecting machine).

SSH server receives that account name and tries to match one of the keys in the authorized_keys file inside the home directory of the provided account.

SSH server also checks permissions to that file and denies login attempt if any user other than the owner could modify it.

---

In a less typical case a global authorized_keys may be configured. Then the file contains %u token for username (refer to man pages).