The normal installation/configuration of SSH on a client requires the use of ssh-keygen to create a local private/public key pair in the .ssh folder of the user's profile.

To configure the normal, secure login process, the client user's public key must be 'copied' to the .ssh/authorized_keys file to in the server user's home folder.

These operations must be performed while the server's sshd configuration is set to allow PasswordAuthentication (yes) and to have the AuthorizedKeysFile value set to the current location of the user's authorized_keys file.

That location may not be in the user's actual /home folder if the server is running Centos 7, which encrypts the user folders, preventing access during ssh login. The AuthorizedKeysFile value would likely be /etc/ssh/%u/authorized_keys in that case.

However, to create a login for the server root account on a client, especially from... say a Mac, creating a root user presents problems.

Therefore, how does one create a user on a client linux/bsd system who will be recognized by ssh on the server, be mapped to the correct alternate (%u) folder for verifying the login's public key when the sshd is properly configured to prevent PasswordAuthentication, AllowRootLogin, and require PublicKeyAuthentication?

Mostly, how do I create a public key for the root user on the client that can be ssh-copy-id or cat-copied to the necessary hacked-in location on the server's /etc/ssh/%u/authorized_keys folder?


  • 1
    "These operations must be performed while the server's sshd configuration is set to allow PasswordAuthentication (yes) ... " Noooope. That's what you have administrators and key management systems for. The public key is, well, not private, so it can be sent out-of-band to an admin who can then add it to the relevant authorized_keys file; or you have an automated tool which takes form input from somewhere and adds the keys. – muru May 13 at 0:51
  • Ok, I'm willing to be corrected. But I was unable to perform the ssh-copy-id with PasswordAuthentication set to NO under any circumstance for any user over the 8 or 9 days I have been trying to find a solution to getting a normal and a root user setup for 'passwordless login'. But an explanation of the principles is not sufficient to provide me with a working solution. Again, are you speaking from a Centos 7 with encrypted user folders persepective? Thanks – Stato Machino May 13 at 3:45
  • The point is that you don't use ssh-copy-id: that's the wrong tool here. You send the key to an admin who will (or use an automated setup which will) copy the public key to the appropriate location. CentOS 7 or encrypted user or whatever makes no difference. – muru May 13 at 4:33
  • 1
    For example, OpenSSH can get keys from a command instead of from a file. One way to use this would be to run a Gitlab server which is itself protected by password + 2FA; this command can use the Gitlab API to get the public key for the relevant user. – muru May 13 at 4:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.