Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

SSH auth by RSA-key: ~/.ssh/authorized_keys. Okay.

Is there a way to set a system-wide authorized key so I can login to any account, including the newly created ones?


The reason: i've got a server and am the only admin. User accounts are used to isolate web-sites from each other just in case any of them is hacked.

I use SFTP and create new accounts often, thus, i'm tired of copying ~/.ssh/authorized_keys :)

share|improve this question
add comment

2 Answers 2

up vote 5 down vote accepted

To login to ANY account?

As an administrator, it should be sufficient for you to login as yourself, and then sudo to the account, but ONLY if necessary.

This approach is a serious security issue, as if that single key that you have for all accounts is stolen, then your system is fully compromised.

I feel there are ethical considerations as you are not identifying yourself in any way that you are acting for the owner. Files might be personal. If one is not all that ethical, one could send emails as the account owner and it would not be traceable.

share|improve this answer
1  
+1, There is no reason you need to do this, log on as yourself and sudo su to another user. This causes all sorts of problems for auditing logs. –  Pratik Amin Nov 11 '11 at 21:03
    
Added "the reason" to the question. However, +1 in general case –  kolypto Nov 11 '11 at 21:11
    
Okay, then, how to SFTP-acess every account? cp? –  kolypto Nov 12 '11 at 0:04
add comment

On most Linux systems, the /etc/skel directory is used to populate the home directory of any new account. If you add a .ssh directory with your authorized_keys file to /etc/skel then you will be able to login to any new account.

For existing accounts, you can write a script to add your key to all of the authorized_keys files on the system.

share|improve this answer
    
The critical failure points here are that (a) one day you may need to change the "system-wide" key, and (b) there's no way to stop users from simply removing it. Trying to manage this sets you up for an administrative nightmare... –  voretaq7 Nov 11 '11 at 22:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.