If I set a custom path for AuthorizedKeysFile, how does sshd decide which user this key belongs to?


Specifies the file that contains the public keys that can be used for user authentication. AuthorizedKeysFile may contain tokens of the form %T which are substituted during connection setup. The following tokens are defined: %% is replaced by a literal '%', %h is replaced by the home directory of the user being authenticated, and %u is replaced by the username of that user. After expansion, AuthorizedKeysFile is taken to be an absolute path or one relative to the user's home directory. The default is ''.ssh/authorized_keys''.

1 Answer 1


sshd doesn’t need to decide which user a key belongs to; it knows which user is attempting to connect (user on the target system), and it knows which key is provided in the attempt.

After expansion, the file pointed to by AuthorizedKeysFile is used to determine whether the provided key is allowed for the target user. Again, it already knows which user this is (and it needs to to replace %u or find the file in the first place when it’s relative to the target user’s home directory).

  • @finefoot with that configuration you're telling sshd that the same authorized keys file is to be used for all users.
    – muru
    Jul 13, 2021 at 15:24
  • 1
    No, in the default configuration an AuthorizedKeysFile is per-user. If you tell sshd to use a shared file, the keys mentioned there can be used to log in with any user. Jul 13, 2021 at 15:32
  • 2
    But yes, the AuthorizedKeysFile configuration directive is global, and %u is the differenciator, along with the home directory of each user if a relative path is used. Jul 13, 2021 at 15:36
  • Have some reputation back ;-). Jul 13, 2021 at 15:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .