10

I have Ubuntu 18.04 and we have an admin account and an account for other users. I have added the public SSH keys of users who need admin access to the admin account, but when I try to do the same for an individual user, I don't see the authorized_keys file in .ssh directory for that user. How should I proceed here?

The below are the commands that I have tried:

cd /home
cd /admin
ls -a
nano .ssh/authorized_keys

Then I add the public key to the admin account. This works for admin but for other users I can't see any authorized_keys file.

2
  • 7
    if it doesn't exist just create it. It's just a plain text file; no special magic. Set perms like chmod go-rwx if your umask is too loose.
    – user339730
    Commented Jan 21, 2021 at 9:49
  • everyone's umask is too loose and you know it. Just chmod go-rwx it and make sur eit's owned by the user, not by root if you were root when you crated it. ssh is especially picky about permissions on this file. You MIGHT also need to consider selinux context depending on how it gets created (by hand or by script running non-interactively) Commented Jan 22, 2021 at 21:37

4 Answers 4

14

Generate an ssh key:

ssh-keygen -t rsa -b 4096 -C "comment"

copy it to your remote server:

ssh-copy-id user@ip

or you can manually append the ~/.ssh/id_rsa.pub to ~/.ssh/authorized_keys:

ssh user@ip 'mkdir ~/.ssh'
ssh user@ip 'cat >> ~/.ssh/authorized_keys' < ~/.ssh/id_rsa.pub
4
  • 5
    "or you can manually copy the ~/.ssh/id_rsa.pub to ~/.ssh/authorized_keys" -- For those new to doing that, if you interpret this literally and scp the file, you'd remove key access of other users. You want to append your key to the file, not copy over it. When ~/.ssh/authorized_keys doesn't exist, it doesn't make a difference for the first, but it does for each subsequent one.
    – JoL
    Commented Jan 21, 2021 at 17:06
  • 2
    Rather than scp, use ssh user@ip 'cat >> ~/.ssh/authorized_keys' < ~/.ssh/id_rsa.pub, so that you don't need to worry about whether or not there is already an authorized keys file.
    – chepner
    Commented Jan 21, 2021 at 18:23
  • 1
    @GAD3R I think you didn't understand my point. I was recommending against doing that. I predict there'll be people that'll take that scp command as an alternative to ssh-copy-id without understanding the limited circumstance in which it's acceptable.
    – JoL
    Commented Jan 21, 2021 at 18:26
  • 1
    Better than to append an ID manually, one can specify an ID file to ssh-copy-id using the -i option: ssh-copy-id -i path/to/id_rsa user@host (.pub is appended if missing). This will create missing directories (~/.ssh) and files (authorized_keys) with the appropriate access mode. Commented Jan 22, 2021 at 14:13
6

The file is created when you run ssh-copy-id <user>@<server>, for example:

sylvester@host3:~> ssh-copy-id arnold@host4
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/sylvester/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
Password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'arnold@host4'"
and check to make sure that only the key(s) you wanted were added.

The file is not present yet because noone has added anything for this user.

5

You do not need any particular tool to create the authorized keys file, or to tell any particular programs that it exists. sshd will look for it each time the user tries to log in.

So quite simply, if it doesn't exist, you can create it the same way you were editing the existing file for a different user.

What you do need to do is make sure the permissions are sufficiently locked down, otherwise sshd will refuse to trust the file. So the steps to create in a completely empty home directory for user joebloggs would look something like this:

# Create the .ssh directory, and set its permissions
mkdir ~joebloggs/.ssh
chown joebloggs ~joebloggs/.ssh
chmod 0700 ~joebloggs/.ssh

# Create the authorized keys file, and set its permissions
touch ~joebloggs/.ssh/authorized_keys
chown joebloggs ~joebloggs/.ssh/authorized_keys
chmod 0600 ~joebloggs/.ssh/authorized_keys

This creates a completely empty .ssh/authorized_keys file, which only joebloggs can access, read, and write.

This is the minimum permission required, following the principle of least privilege. If you want, you can allow read-only access to a particular group (chgrp -R some-group ~joebloggs/.ssh; chmod 750 ~joebloggs/.ssh; chmod 640 ~joebloggs/.ssh/authorized_keys), or to all users on the system (chmod 755 ~joebloggs/.ssh; chmod 644 ~joebloggs/.ssh/authorized_keys). The important thing is that they must not be able to write to it, or the SSH daemon will not trust its contents.

3
  • Permissions for authorized keys is supposed to be 644 and the chown commands need to add permission for the user and group to own it not just the user. I am using Redhat/Amazon Linux for reference.
    – Tony-Caffe
    Commented Oct 10, 2022 at 19:30
  • @Tony-Caffe I can't think of any reason for anybody other than the user logging in to read the file, so no need for any group or "other" permissions; and if there's no group permissions, it doesn't matter which group owns the file. The only thing I have changed looking back at this is that the file doesn't need to be executable, so can be 0600 (rw----) rather than 0700 (rwx------).
    – IMSoP
    Commented Oct 10, 2022 at 19:58
  • @Tony-Caffe I've added a note that it doesn't hurt to allow other users to read the file; if you know of a specific scenario where a user other than the owner needs to, and can clarify which user, I will add that.
    – IMSoP
    Commented Oct 11, 2022 at 15:51
1
  1. ssh-keygen (press enter / do not enter any passwords)

  2. ssh-keyscan hpc.university.edu > known_hosts (press enter)

  3. ssh-copy-id [email protected] ( press Enter) you might need some password to go through university VPN in this case , you can enter them )

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .