3

I have a lot of ssh public key logins on a Linux server, e.g.:

Jul 25 11:41:01 host sshd[24594]: Accepted publickey for root from xxx.xxx.xx.xx port 33374 ssh2

This is strange for me since there's no authorized_keys file in the /root/.ssh directory. The AuthorizedKeysFile option in /etc/ssh/sshd_config has the default value of .ssh/authorized_keys.

I wonder how is it possible to login to the server using public key authentication?

  • Do you know if sshd_config has been modified since sshd was last restarted? – Bratchley Jul 25 '14 at 19:35
  • @Joel: yep, I've tried restarting the sshd service. – Eugene Yarmash Jul 25 '14 at 22:09
  • What else is inside /root/.ssh? Is there for instance an authorized_keys2 file? If you can restart sshd, you can restart it with verbose logging. Examine what files it looks at during one of these episodes – BowlOfRed Jul 25 '14 at 22:19
2

I've figured out what's going on. The messages are coming to the server from remote hosts via UDP. I didn't notice the host field changing at first, my mistake.

BTW, actually there is a possibility to login using public key authentication with no authorized_keys file involved. RedHat (and variants) have a supported patch for OpenSSH that adds the AuthorizedKeysCommand and AuthorizedKeysCommandRunAs options. The patch has been merged upstream in OpenSSH 6.2. To quote from the man page:

AuthorizedKeysCommand

Specifies a program to be used for lookup of the user's public keys. The program will be invoked with its first argument the name of the user being authorized, and should produce on standard output AuthorizedKeys lines (see AUTHORIZED_KEYS in sshd(8)). By default (or when set to the empty string) there is no AuthorizedKeysCommand run. If the AuthorizedKeysCommand does not successfully authorize the user, authorization falls through to the AuthorizedKeysFile. Note that this option has an effect only with PubkeyAuthentication turned on.

AuthorizedKeysCommandRunAs

Specifies the user under whose account the AuthorizedKeysCommand is run. Empty string (the default value) means the user being authorized is used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.