160

Just wanted a quick summary of the differences between them and why there are two?

  • 10
    Gotta love those sequential-numbered files where the numbers bear no relation to their function, version or description. – Mark Henderson May 16 '11 at 0:04
  • @Mark Henderson: yes, what are other examples? – smci Nov 26 '12 at 22:19
137

In OpenSSH prior to version 3, the sshd man page used to say:

The $HOME/.ssh/authorized_keys file lists the RSA keys that are permitted for RSA authentication in SSH protocols 1.3 and 1.5 Similarly, the $HOME/.ssh/authorized_keys2 file lists the DSA and RSA keys that are permitted for public key authentication (PubkeyAuthentication) in SSH protocol 2.0.

The release announcement for version 3 states that authorized_keys2 is deprecated and all keys should be put in the authorized_keys file.

27

The use of authorized_keys2 for protocol 2 has been deprecated since 2001.

[via]

  • 7
    If only someone would tell redhat that... authorized_keys fails, authorized_keys2 works fine. – El Yobo Sep 20 '11 at 2:33
  • redhat stuff was last built in 2001 ;-) – Ring Ø Aug 24 '12 at 2:13
  • So .. what IS the answer here - I am on CentOS 6.2? – javadba Jul 7 '14 at 15:21
  • @javadba: CentOS is in the same boat as Red Hat. – Dennis Williamson Jul 7 '14 at 15:36
  • @DennisWilliamson Right.. so is RH (/CentOS) requiring authorized_keys2 or not? My test just now indicates authorized_keys is sufficient.. but would be nice for more insight – javadba Jul 7 '14 at 16:02
8

Originally the difference was for version differentiation.

But don't bother any more, as now the 2 can be ignored.

4

One really good reason to use authorized_keys2 is if you have a VPS with Arvixe where the tech support team continually overwrites your authorized_keys file.

1

I also liked that there was a second authorized_keys file.

I use and distribute my authorized_key file to multiple computers, limiting my access so only my primary home is allowed to login to other accounts. But that generally means it is the same on all my accounts, and is overwritten if it is different. I have also seen other computer configuration programs overwrite it continuously (Puppet).

However when I login to the front node of a large cumputing cluster, I like to put the keys in authorized_keys2 file, so that the front node can access the other nodes of the cluster, but does not have access to any other machine. that is I used it as a 'local authorization file', as separate to a 'distributed authorization file'.

It becomes especially important when shared homes are used (as they generally are on a cluster).

It is a real shame it is now depreciated.

An alternative that would be nice would be a include mechanism, or a "authorized_keys.d" sub-directory, or a 'use these keys for this host'.

  • 3
    You can specify a list of files to use as authorized_keys files using the AuthorizedKeysFile config setting. You can even still use authorized_keys2 as one of the files if you like. – Eborbob Nov 27 '17 at 12:04
  • Thanks. I did not know you can list multiple files in that option. Especially as the first words in the manpage for it was... Specifies the file that... Singular file rather than plural files. But that was clarified later. Thanks again. – anthony Nov 29 '17 at 0:23

protected by Khaled Jun 11 '12 at 8:24

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.