ssh into an account which has no home directory

Question

As a follow up to my previous question, I have decided to create the local user accounts as below.

adduser --system --no-create-home USERNAME

Now, I would like the local users to be able to access the machines using ssh. As per my understanding, ssh works as below.

Assuming I have 2 machines (say alpha and beta).

• From alpha machine: ssh user@beta
• alpha's public key will be present under ~/.ssh/authorized_keys in beta machine.
• alpha's private key will be present under /~/.ssh in the alpha machine.

Now I have planned to implement no home for the users. So assuming I adduser into beta machine without any home for any user, will I still be able to ssh into beta from alpha?

Answer 1

~/.ssh/ is just the default location that sshd uses to look for incoming user's public keys. You can configure the location and the file that sshd looks for by modifying the AuthorizedKeysFile directive in /etc/ssh/sshd_config. Mine currently looks like:

AuthorizedKeysFile     %h/.ssh/authorized_keys

The sshd_config man page provides a little more detail:

 AuthorizedKeysFile
     Specifies the file that contains the public keys that can be used for user authentication.  The format is
     described in the AUTHORIZED_KEYS FILE FORMAT section of sshd(8).  AuthorizedKeysFile may contain tokens of
     the form %T which are substituted during connection setup.  The following tokens are defined: %% is
     replaced by a literal '%', %h is replaced by the home directory of the user being authenticated, and %u is
     replaced by the username of that user.  After expansion, AuthorizedKeysFile is taken to be an absolute
     path or one relative to the user's home directory.  Multiple files may be listed, separated by whitespace.
     The default is “.ssh/authorized_keys .ssh/authorized_keys2”.

Just be aware that sshd is very particular about the permissions of a user's authorized_key file. You'll want to keep a close eye on your logs if you set this up and run into problems logging in.