0

I'm only starting to learn SSH.

Is it possible to have per-host authorized_keys file (eg /etc/ssh/authorized_keys) to allow passwordless login for every user of the given host?

To test I've tried to connect (to a server having my public keys in ~/.ssh/authorized_keys passed by ssh-copy-id) through ssh -i /etc/ssh/ssh_host_rsa_key.pub, although without success.

I'm not sure if the -i switch can be valid for public keys, but I've successfully tried (by checking on the remote side) ssh-copy-id -i <server> to pass the specified public key to the server to append to its user's ~/.ssh/authorized_keys file.

Is it mandatory to have ~/.ssh for every user, or is it also possible to have system-wide keys and files (such as known_hosts and authorized_keys) applicable to every user on the system?

I think per-host authentication should be possible as per-user is, but I am not certain.

  • The whole point of SSH keys is they are per user, I suggest you go revise the fundamental basics of PKI. Sharing SSH keys is pointless and defeats the additional security PKI provides. – Little Code May 10 '17 at 7:36
  • 1
    There is a really good resource for OpenSSH at wikibooks. It may help you find things quicker than man pages: en.wikibooks.org/wiki/OpenSSH – 0xSheepdog May 10 '17 at 20:09
  • Having a user with a key which is known to all users of a host would simulate your desired property. But keep in mind that if a user had once access to the key she can copy and reuse it (if you not wrap it in Smartcard or TPM) – eckes May 10 '17 at 20:24
0

It sounds like you want to use Host Based Authentication, and there is a good source of information at the OpenSSH wikibook site. Link here

Please keep in mind that any host based authentication has inherent security issues, and you should be diligent with configurations to ensure only the approved accounts and processes are allowed to utilize this feature.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy