3

Users are only allowed via SFTP and only with pubkey. There is 1 UNIX user on the system and many ssh pubkeys in the authorized_keys file.

Q: How can I prevent the users to download the ~/.ssh/authorized_keys file? I know it is needed for login, but I want to restrict them, so they will not know who is allowed on the SFTP server.

1

You can configure your server to find this file somewhere else (out of the users home) using for example:

AuthorizedKeysFile /etc/ssh/authorized_keys/%u

Still these files would be readable for the users. The other possibility is to use

AuthorizedKeysCommand /usr/sbin/get_user_keys
AuthorizedKeysCommandUser dedicated_user

And the command /usr/sbin/get_user_keys will fetch the keys for users from different location (for example the above) using dedicated user. The logging user will not be able to see the other keys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.