Why don't I have to regenerate keys when I change a user's password?

Question

We have a Linux box (Ubuntu, but that shouldn't matter), say, somemachine.example.com, and a user that has access to that machine, someuser.

I can SSH into that machine either by explicitly provided a password for someuser like so:

ssh someuser@somemachine.example.com
Password: *****

...or by providing a PEM file (public key):

ssh -i ~/path/to/somemachine.pem someuser@somemachine.example.com

Today I had to change the password for someuser on that box (using the passwd command), and was a little surprised to learn that I didn't have to also regenerate new keypairs (thus, new PEM file) for that user as well.

I'm wondering: why? Is there simply no connection between someuser's password and the public/private key? If so, does Linux maintain, for each user, a set of credentials, which could either be passwords or public keys? How does Linux associate keys and passwords with particular users?

Answer 1

ssh keys and login-passwords are stored in separate locations on virtually any Unix-like system. There's no reason why (aside from 30 years of history preceding ssh) the two couldn't have used the same storage. But what we have now is separate, with scattered attempts to store the collection of credentials in key-managers.

Typically a user's ssh information is in $HOME/.ssh, while the logon information is in /etc/passwd, /etc/shadow/, /etc/group and /etc/gshadow.

A key manager could combine those, by providing passwords (or the analogous information) as needed. But that's the exception rather than the rule.

Not to recommend it one way or the other, I worked with SnareWorks a while back. If you google on that, it appeared on the scene around 2000. That collected the credentials for various applications (or remote systems) and associated the collection with a user.

Answer 2

SSH keys are not linked you the users password at all, they are two completely separate authentication mechanisms. When ssh keys are used sshd looks in $HOME/.ssh/authorized_keys or $HOME/.ssh/authorized_keys2 for public keys to try. It these public keys with the private key on the client and some crypt magic to authenticate the user.

When ssh uses password auth, it uses PAM to do the authentication. PAM can authenticate the use in a variety of ways, but the most common is using the local user logins. Local users login credentials are stored in /etc/passwd and their passwords are stored in /etc/shadow, group information is stored in /etc/group.