Add key to authorized_users without needing to restart sshd

Question

I am trying to add a public key to a server but I don't want to restart the sshd service for it to take effect. The reason is that restarting the ssh service seems to be disruptive for other users who could use the ssh service at that time. Most documentation suggest to add a public key to $HOME/.ssh/authorized_keys and then to restart the sshd service (systemctl restart sshd). The OS of interest is Linux.

My questions are:

1. Is the restart of sshd needed?
2. If sshd is restarted, is there a service outage at that time?
3. Is there a way to set up passwordless auth using ssh without needing to restart the sshd service after adding new public keys to $HOME/.ssh/authorized_keys?

Answer 1

Is the restart of sshd needed?

Not usually. Linux distributions usually ship with a default configuration that allows public key authentication, so you usually don't even have to edit configuration to enable it, and so restarting is unnecessary. Even in the case that you had to do something with sshd_config, you'd only have to restart it only once after editing that file, not for each edit after of the authorized keys file.

Note that you don't even have to restart sshd. From man sshd:

sshd rereads its configuration file when it receives a hangup signal, SIGHUP, by executing itself with the name and options it was started with, e.g. /usr/sbin/sshd.

And the typical systemd service for sshd recognizes this, so you can do systemctl reload sshd instead.

If sshd is restarted, is there a service outage at that time?

Depends on your definition of service outage. A simple restart of sshd will not kill existing ssh connections, but new connections wouldn't be accepted until sshd finishes restarting.

Answer 2

The best way is to use

ssh-copyid [email protected]

Where N is the IP address

OR

ssh-copyid user@fqdn

where fqdn is the Fully Qualified Domain Name (eg server.domain.com)

This does not require any daemon restarts

Answer 3

In my case I needed to add the key to ssh agent:

ssh-add ~/.ssh/id_rsa