Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

So SSH has these files that configure settings for a specific user.

~/.ssh/authorized_keys
~/.ssh/config
~/.ssh/id_rsa
~/.ssh/id_rsa.pub
~/.ssh/known_hosts

I'd like to globalise some of these files, like config and known_hosts. So that other users ( including root ) could share the configured hosts.

What would be the best way to do this?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

For ~/.ssh/config you can place relevant system-wide settings in /etc/ssh/ssh_config according to the man page:

ssh(1) obtains configuration data from the following sources in the following order:

  1. command-line options
  2. user's configuration file (~/.ssh/config)
  3. system-wide configuration file (/etc/ssh/ssh_config)

For each parameter, the first obtained value will be used. The configuration files contain sections separated by “Host” specifications, and that section is only applied for hosts that match one of the patterns given in the specification.

Note that only the first value will be used, which means that the user can always override the system-wide configuration options locally.

For ~/.ssh/known_hosts you can use /etc/ssh/ssh_known_hosts or another file specified by the GlobalKnownHostsFile configuration option:

GlobalKnownHostsFile

Specifies a file to use for the global host key database instead of /etc/ssh/ssh_known_hosts.

I'm unsure if it is possible for the other files, but I imagine you could work something out with symlinks if you really wanted to share private keys among users as well.

share|improve this answer
1  
You've got a typo in your GlobalKnownHostsFile quote. –  cjm Oct 30 '10 at 23:52
    
Fixed it. Thanks! –  Steven D Oct 30 '10 at 23:58

Since root is all powerful, I would use a root cron job to copy the files form other users. Known Hosts and authorized keys can simply be appended. If it's all on one partitions there's the hardlink option. Not sure if symlinks would work for the files, but you could try that, too, you just have to put them in in a shared, yet secure place.

share|improve this answer
    
It would prevent users from adding their own hosts which IMHO is unintended effect. –  Maciej Piechotka Oct 31 '10 at 0:05
    
I forget if a hardlink file has to have same perms but I suspect it does. However you could copy the file with cron and then make sure the perms are correct. –  xenoterracide Oct 31 '10 at 4:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.