search

BradleyA / docker-security-infrastructure

Automate the generation, setup, check, copy site, host and user docker TLS certificates; Setup and manage dockerd configuration for Ubuntu 16.04 Systemd & Ubuntu 14.04 Upstart. Check ssh permissions
MIT License
17 stars 8 forks source link

ssh/check-user-ssh.sh - check for additional authorized_keys when encrypted home directory #51

Open BradleyA opened 5 years ago

BradleyA commented 5 years ago

ssh supports additional locations for authorized_keys file in /etc/ssh/sshd_config (AuthorizedKeysFile). Use case: If you have an encrypted home directory, SSH cannot access your authorized_keys file because it is inside your encrypted home directory and won't be available until after you are authenticated. Therefore, SSH will default to password authentication.

To solve this, create a folder outside your home named /etc/ssh/ (replace "" with your actual username). This directory should have 755 permissions and be owned by the user. Move the authorized_keys file into it. The authorized_keys file should have 644 permissions and be owned by the user.

Then edit your /etc/ssh/sshd_config and add:

AuthorizedKeysFile /etc/ssh/%u/authorized_keys

Need to add check for other authorized_keys file location in /etc/ssh/sshd_config file

BradleyA commented 5 years ago

The release announcement for version 3 states that authorized_keys2 is deprecated and all keys should be put in the authorized_keys file. https://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2