8

I want to be able to specify the keys in 2 separate files, one user controlled, the other auto generated by a tool.

How can I make it so that a file like ~/.ssh/authorized_keys_generated also gets checked for keys on login?

2 Answers 2

11

Simply append the name of the file next to the old one.

AuthorizedKeysFile ~/.ssh/authorized_keys ~/.ssh/authorized_keys_generated

3
  • 2
    For what it is worth, the default already contains two files: .ssh/authorized_keys .ssh/authorized_keys2. Jan 27, 2020 at 23:22
  • In one sshd config I've seen this: # Expect .ssh/authorized_keys2 to be disregarded by default in future. so I wouldn't rely on that authorized_keys2 to be an alternative to authorized_keys
    – Paul M
    Dec 8, 2020 at 16:31
  • As of "OpenSSH_9.0p1, OpenSSL 1.1.1q 5 Jul 2022" official man page still states that: 'The default is ".ssh/authorized_keys .ssh/authorized_keys2''
    – EnzoR
    Aug 19, 2022 at 9:46
2

This not exactly your question, but you also could use AuthorizedKeysCommand in ssh config file. sshd will launch the command with the user as the first parameter and the stdout of the script should be a string matching authorized_keys format.

You could use a script like :

#!/bin/bash
for file in /home/$1/.ssh/*.pub; do
   cat $file;
done

That echos all file in public key in ~/.ssh, granting access to every key in it.

But there is more to it, AuthorizedKeysCommand could be use to call a authorization server that grants access based on your business logic, for instance. It's a powerful tool.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .