0

I've generated a pair of keys with PuttyGen and I use it to connect to a remote server with Putty and SSH.

What surprises me is that, when configuring the public key authentication, at no moment I had to provide a login. The only moment I had to do that is when I had to log in the server to update the file .ssh/authorized_keys. But that log-in could have been done with any user that has the right to update that file.

I've checked the content of the public/private keys and the file authorized_keys, I've seen no info about the login.

When I log in, the login is asked then directly the server seems to look for a public key linked to that login. Where does it look for that link ?

2

The "public key - login" link is inferred from the place where the public key is stored: it is added to the .ssh/authorized_keys on the server inside a specific user's home directory.

In a typical use case each account has a separate authorized_keys file. If it doesn't exist, you cannot connect to that account with an SSH key-based authorisation.

SSH client provides the account name you want to login to (on Unix-based systems the ssh command executed without account name will request login to the account name currently used on the connecting machine).

SSH server receives that account name and tries to match one of the keys in the authorized_keys file inside the home directory of the provided account.

SSH server also checks permissions to that file and denies login attempt if any user other than the owner could modify it.


In a less typical case a global authorized_keys may be configured. Then the file contains %u token for username (refer to man pages).

  • Indeed, I haven't noticed that there is one file authorized_keys per user, I thought that this file was shared. – Coli Aug 23 '16 at 8:56
  • 1
    That's the common use case. It can be configured globally per server. – techraf Aug 23 '16 at 8:59
  • "tries to match" - what does that mean, in detail? – aaa90210 Apr 2 '18 at 23:39
  • It takes the data received from the client and tries to decrypt it using the first public key found in the authorized_keys. If it fails, it tries with the second. And so on. – techraf Apr 4 '18 at 0:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.