1

I'm not sure I understand the purpose of ~/.ssh/authorized_keys.

In my ~/.ssh directory, I have

-rw-------  1 tomcat tomcat 1685 Nov  4  2016 authorized_keys
-rw-------  1 tomcat tomcat 1671 Nov 21  2011 id_rsa
-rw-r--r--  1 tomcat tomcat  413 Nov 21  2011 id_rsa.pub
-rw-r--r--  1 tomcat tomcat 7111 Jul 14 09:30 known_hosts

If id_rsa.pub contains my public key, why would I need authorized_keys to list who is allowed to SSH as my user? Wouldn't that be only that user?

What is the purpose of additional authorization via authorized_keys on top of the public key?

Improve this question

2 Answers 2

Reset to default
2

The authorized_keys file is composed of the public keys for users who are permitted remote access to that account on that system.

In general, you have a set of keys for each user account, on each system. The private key is kept only on the system where it was created, and the public key is copied to other systems. In the case of SSH, the public key is copied into the authorized_keys file for your account on a remote system. Using keys can be both more convenient and more secure than relying on passwords for SSH access.

Imagine you're setting up a remote server, that you and several other people will operate, though a shared account on that server. You copy the public key from your local system, and the public keys from the other people, into the authorized_keys file for that remote system. This will allow all of you to access that remote server through keys as soon as it's set up. If you were setting up a lot of identical servers, you could simply copy the same authorized_keys file to each of them. If someone leaves the team, you can simply remove their public key from the authorized_keys file, and they should no longer have access to that system.

Here's some more general information on SSH:

Improve this answer
1
  • 2
    A real-life example of this is a user named git who owns your repositories on the server. Any user who has a key in authorized_keys can read/write the repo.
    – Aaron D. Marasco
    Oct 17, 2017 at 22:41
1

You might have a seperate key on your computer at work, and also allow yourself access using that. then you would need two keys in the authorized_keys file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .