1

I manage a legacy system that numerous clients connect to in order to consume large files of scientific data. Currently these users connect via SFTP, and because of the huge diversity of experience levels and use cases, password authentication has been the easiest way to work with all of them. Many of them are just sales people connecting from Windows and using something like FileZilla, and it would cause a huge support burden.

A new client has insisted(justifiably) on SSH public key authentication. What is the best way for me to provide this option to my new client without disrupting the auth strategies my other 100+ clients are using?

My current sshd_config looks like this:

Match group sftpusers
        ChrootDirectory /sftp/%u
        X11Forwarding no
        AllowTcpForwarding no
        ForceCommand internal-sftp -l VERBOSE -f LOCAL6

Obviously I had to add a prior "PasswordAuthentication yes" line farther up the file.

The server is configured to permit only SFTP logins for users, and all end users are members of this "sftpusers" group.

Follow up dumb question: Where would I even place an SSH key for a user with no home folder?

1 Answer 1

1

Where would I even place an SSH key for a user with no home folder?

There is option AuthorizedKeysFile, which defines the place for authorized keys are stored. It defaults to home directory, but it doesn't have to be. Quite common is also this configuration:

AuthorizedKeysFile    /etc/ssh/%u/authorized_keys
2
  • Thank you! This has ended up being the last sticking point, very insightful. I have added Match blocks in my sshd_config file to match users and override authentication options. Now I am reviewing the output of SSHD run in debug mode, and seeing permissions errors pointing to the wrong file. Nov 3, 2015 at 22:07
  • I've clarified and made this question more specific here: serverfault.com/questions/733718/… Thanks for your patience and help herding me toward a more specific question! Nov 3, 2015 at 23:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .