23

So SSH has these files that configure settings for a specific user.

~/.ssh/authorized_keys
~/.ssh/config
~/.ssh/id_rsa
~/.ssh/id_rsa.pub
~/.ssh/known_hosts

I'd like to globalise some of these files, like config and known_hosts. So that other users ( including root ) could share the configured hosts.

What would be the best way to do this?

Improve this question

2 Answers 2

Reset to default
31

For ~/.ssh/config you can place relevant system-wide settings in /etc/ssh/ssh_config according to the man page:

ssh(1) obtains configuration data from the following sources in the following order:

  1. command-line options
  2. user's configuration file (~/.ssh/config)
  3. system-wide configuration file (/etc/ssh/ssh_config)

For each parameter, the first obtained value will be used. The configuration files contain sections separated by “Host” specifications, and that section is only applied for hosts that match one of the patterns given in the specification.

Note that only the first value will be used, which means that the user can always override the system-wide configuration options locally.

For ~/.ssh/known_hosts you can use /etc/ssh/ssh_known_hosts or another file specified by the GlobalKnownHostsFile configuration option:

GlobalKnownHostsFile

Specifies a file to use for the global host key database instead of /etc/ssh/ssh_known_hosts.

I'm unsure if it is possible for the other files, but I imagine you could work something out with symlinks if you really wanted to share private keys among users as well.

Improve this answer
4
  • 1
    You've got a typo in your GlobalKnownHostsFile quote.
    – cjm
    Oct 30, 2010 at 23:52
  • 1
    You can set UserKnownHostsFile=/dev/null ssh will never find a valid key inside users known_hosts file but still user can accept one temporary.
    – Janning
    Jul 23, 2015 at 9:56
  • 1
    @Janning, it looks like there's actually an IgnoreUserKnownHosts option for that (values yes or no).
    – kael
    Feb 14, 2018 at 18:35
  • Note that the global /etc/ssh/ssh_known_hosts file must be world-readable. I was using ssh-keygen -Hf /etc/ssh/ssh_known_hosts to rehash mine after manually adding entries, and it appears that it was being set to owner-only.
    – kael
    Feb 14, 2018 at 19:17
1

Since root is all powerful, I would use a root cron job to copy the files form other users. Known Hosts and authorized keys can simply be appended. If it's all on one partitions there's the hardlink option. Not sure if symlinks would work for the files, but you could try that, too, you just have to put them in in a shared, yet secure place.

Improve this answer
2
  • 2
    It would prevent users from adding their own hosts which IMHO is unintended effect.
    – Maciej Piechotka
    Oct 31, 2010 at 0:05
  • I forget if a hardlink file has to have same perms but I suspect it does. However you could copy the file with cron and then make sure the perms are correct.
    – xenoterracide
    Oct 31, 2010 at 4:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .