i want to enable access to a home dirs via ssh/scp with an key. Normally i would place the pub key into ~/ssh/authorized keys But i want

  • disable the ability to add or remove ssh-keys (turn off ~/ssh/authorized_keys)
  • The user should not be able to rm -f pub_key, modify pub_key wherever it sits in the system
  • make the directory where the pub keys for different accounts are stored not readable for "normal" user, e.g. like /etc/sudoers.d/ is only readable by root1

Is that possible? How would i do that?

  • See troubleshooting section of help.ubuntu.com/community/SSH/OpenSSH/Keys
    – Jeff Schaller
    Feb 5 '16 at 19:51
  • The trouble shooting section allows the user to modify the authorized_keys, because it sets the pub_key to user permissions.
    – Mandragor
    Feb 5 '16 at 19:55
  • AuthorizedKeysFile /etc/ssh/%u/authorized_keys
    – Jeff Schaller
    Feb 5 '16 at 19:56
  • See 2 sentences befor this statement, "This directory should have 755 permissions and be owned by the user." again the user can do what he wants with the file (he owns it)
    – Mandragor
    Feb 5 '16 at 19:58
  • True --if they know where it is
    – Jeff Schaller
    Feb 5 '16 at 19:58

There are two things that you want to achieve:

  • Disallow the authentication using ~/.ssh/authorized_keys

    As proposed set AuthorizedKeysFile to some different place. If there is the discussed requirement, it will not be evaluated (otherwise there is nothing more to solve).

  • Set AuthorizedKeysCommand

    The command will return you the authorized keys from your the location of your own choice.

For example:

AuthorizedKeysFile /etc/ssh/%u/authorized_keys
AuthorizedKeysCommand /usr/sbin/get_user_keys
AuthorizedKeysCommandUser dedicated_user

And your script /usr/sbin/get_user_keys might look like:

cat /etc/ssh/%u/authorized_keys

This makes basically the keys read-only and solves your issues.


There's one thing you can do without editing system configuration files to get most of what you want. You'd just use ~user/.ssh/authorized_keys and all the rest like normal and make those immutable.

You can set the ~user/.ssh directory immutable, which prevents moving it or deleting it, which is important if you don't want them to create a new .ssh with their own contents. It also prevents adding, moving, or deleting files within it.

You can set various files (like ~user/.ssh/authorized_keys or ~user/.ssh/id_rsa.pub) immutable, which prevents moving them or deleting them. It also prevents editing them.

Note that immutable directories and files are protected in this way even against their owners. They're even protected in this way against the root user until root removes the immutability.

Make sure to set the permissions for the directories and files properly for privacy before setting them immutable, since immutability blocks even that.

You set something immutable like this:

sudo chattr +i [directory path|file path]

A particularly convenient command protects .ssh and all files within it (recursively if you have subdirectories) in one go:

sudo chattr -R +i ~user/.ssh

To turn off immutability to change something (make sure to turn it back on when you're done):

sudo chattr -i [directory path|file path]

Note that a quick way to be able to edit whatever you want is:

sudo chattr -R -i ~user/.ssh

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.