I manage a legacy system that numerous clients connect to in order to consume large files of scientific data. Currently these users connect via SFTP, and because of the huge diversity of experience levels and use cases, password authentication has been the easiest way to work with all of them. Many of them are just sales people connecting from Windows and using something like FileZilla, and it would cause a huge support burden.
A new client has insisted(justifiably) on SSH public key authentication. What is the best way for me to provide this option to my new client without disrupting the auth strategies my other 100+ clients are using?
My current sshd_config looks like this:
Match group sftpusers
ChrootDirectory /sftp/%u
X11Forwarding no
AllowTcpForwarding no
ForceCommand internal-sftp -l VERBOSE -f LOCAL6
Obviously I had to add a prior "PasswordAuthentication yes" line farther up the file.
The server is configured to permit only SFTP logins for users, and all end users are members of this "sftpusers" group.
Follow up dumb question: Where would I even place an SSH key for a user with no home folder?