Is there a way to configure SSH to check a single authorized_keys file for multiple users? I know I can copy the public key into each user's authorized_keys file but for ease of management I'd like an additional authorized_keys file for the administrators that would allow them to login to all the users (or specific groups of users).
You can use the
AuthorizedKeysFile directive in /etc/ssh/sshd_config to do this. The defaut location is
.ssh/authorized_keys but you could use something which contained an absolute path e.g.
the man pages says this
Specifies the file that contains the public keys that can be used for user authentication. AuthorizedKeysFile may contain tokens of the form %T which are substituted during connection setup. The following tokens are defined: %% is replaced by a literal ’%’, %h is replaced by the home directory of the user being authenticated, and %u is replaced by the username of that user. After expansion, AuthorizedKeysFile is taken to be an absolute path or one relative to the user’s home directory. The default is “.ssh/authorized_keys”.
Your administrators should use and appropriate (for your environment) combination of
ssh is not the right tool for this.
Contradictory Edit (Sorry, looks like I suffered from title blindness. Thank you Zoredache):
Put all of the service accounts in the same
group, use that group as part of a
Match block in
sshd_config specify the
AuthorisedKeysFile you want them all to use.
(The match group is so that all accounts are not effected.)
They will, however, no longer have individual AuthorisedKeysFiles.
openssh-lpk may allow the individual accounts to have their own keys in addition, but I'm not sure about that.
Edit: You should upvote @Iain's answer above. It is complete and accurate. My answer below is geared towards shared private keys - clearly a misunderstanding on my part. I'll leave this answer here, since I consider it a valuable piece of information, just not for this specific question.
I don't know your use-case, but I'm tempted to say "you're doing it wrong."
Each user should have their own kepair. That way, when a user leaves, is transferred, promoted to a management role, or anything else that requires revocation of rights, you just revoke that one key. This also makes effective auditing much, much harder.
If you need users to be able to impersonate other users, they should be configured to do so with
sudo. Having shared SSH keys is normally not a good idea.
As of writing of this post, it can be accomplished with this configuration in sshd_config:
AuthorizedKeysFile .ssh/authorized_keys /etc/ssh/authorized_keys
And making sure /etc/ssh/authorized_keys is readable by at least the user you're trying to login as. If it's chmod 600, readable by root only, it will not work.
chmod 644 /etc/ssh/authorized_keys
Then it will work.
This way no need to consolidate unnecessarily all SSH public keys into one place, and we preserve the natural functionality of looking in
Since the file only contains public keys, we chmod to 644 to make it world-readable but not world-writable. An alternative way would be to create a custom group to expose it slightly less, but regardless, more than one user will always have to have access to this file no matter what we do, so it's unnecessary to make permission too convoluted for this file in this case.
Please note that all users includes
root as well, so you should only add yourself to
/etc/ssh/authorized_keys on a server you already have root access to.