I frequently SSH into a remote Linux server of which I am an authorized user. In order to make the communication more secure, I setup the public/private key authentication instead of using password for login. I sent my public key to server's administrator and he added it to ".ssh/authorized_keys" under my home directory. Everything went well right off the bat and I could connect from my Linux laptop to the server without using my password on first attempt.

Now the question - if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?

(PS: If the answer is "yes" then I'd be very very very careful if I were an administrator because seems like somewhat easy mistake to make.)

Let me know if additional information is needed to answer the question correctly.

Thanks!

  • 1
    Yes, but you need to know which user's authorized_keys file the admin added your key to. BTW - instead of sending the key to the admin, you could probably have used ssh-copy-id and done it yourself.... – ivanivan Jan 30 at 20:35
  • @ivanivan Thanks for the ssh-copy-id tip, I will remember it for next time. Your comment about the knowledge of username also makes sense. That makes me somewhat less spooked now. But still spooked nonetheless. – user309223 Jan 30 at 20:48

if server's administrator had accidentally placed my public key under another user's "authorized_keys" then could I have logged in as that user?

In a word: yes. The same way as if they sent you the other user's password, or saved your password under the other user's account.

  • 2
    The only exception perhaps is that both admin and I would think twice before sending out passwords to each other. However, public key is public information that I (or admin) might be little less careful about. But I see the point of you analogy. Thank you. – user309223 Jan 30 at 20:53

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.