SSH auth by RSA-key: ~/.ssh/authorized_keys. Okay.

Is there a way to set a system-wide authorized key so I can login to any account, including the newly created ones?

The reason: i've got a server and am the only admin. User accounts are used to isolate web-sites from each other just in case any of them is hacked.

I use SFTP and create new accounts often, thus, i'm tired of copying ~/.ssh/authorized_keys :)


To login to ANY account?

As an administrator, it should be sufficient for you to login as yourself, and then sudo to the account, but ONLY if necessary.

This approach is a serious security issue, as if that single key that you have for all accounts is stolen, then your system is fully compromised.

I feel there are ethical considerations as you are not identifying yourself in any way that you are acting for the owner. Files might be personal. If one is not all that ethical, one could send emails as the account owner and it would not be traceable.

  • 1
    +1, There is no reason you need to do this, log on as yourself and sudo su to another user. This causes all sorts of problems for auditing logs. – Pratik Amin Nov 11 '11 at 21:03
  • Added "the reason" to the question. However, +1 in general case – kolypto Nov 11 '11 at 21:11
  • Okay, then, how to SFTP-acess every account? cp? – kolypto Nov 12 '11 at 0:04

On most Linux systems, the /etc/skel directory is used to populate the home directory of any new account. If you add a .ssh directory with your authorized_keys file to /etc/skel then you will be able to login to any new account.

For existing accounts, you can write a script to add your key to all of the authorized_keys files on the system.

  • The critical failure points here are that (a) one day you may need to change the "system-wide" key, and (b) there's no way to stop users from simply removing it. Trying to manage this sets you up for an administrative nightmare... – voretaq7 Nov 11 '11 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.