Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I configure OpenSSH (5.9) to reject a given set of public keys?

I know I can remove the keys from each respective .ssh/authorized_keys file, but I would like to do it on a server-wide basis. Imagine a scenario where a private key got compromised and I would like to prevent any user from putting the respective public key into their authorized_keys (yes, they should still be allowed to edit theirs) and it working. To achieve that I will need something that works at the system level.

share|improve this question
up vote 5 down vote accepted

Have a look into the RevokedKeys configuration option for the sshd. See man sshd_config.

share|improve this answer
Is this a recent addition or has that feature even disappeared again? There is no such option in the man page, I'm afraid. What OpenSSH version are you using? – 0xC0000022L Feb 25 '13 at 13:30
It's not in 5.3 as used on CentOS 6, but on a Ubuntu 11.10 with ssh 5.8 it's available, as well as on ssh 5.5 on Debian Squeeze and it's listed on the OpenSSH webpage's version of the manual pages, so it hasn't been removed. – Sven Feb 25 '13 at 13:34
snap. Found it on Ubuntu 12.04. Not on Scientific Linux 6.3 or Ubuntu 10.04, however. Luckily I am migrating to 12.04. Thanks for the help. +1 and accepting, of course :) – 0xC0000022L Feb 25 '13 at 13:39
This option was added in OpenSSH 5.4. ; 5th added feature. – Jander Mar 25 '15 at 20:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.