enable access via ssh-key without using ~/ssh/authorized_keys

Question

i want to enable access to a home dirs via ssh/scp with an key. Normally i would place the pub key into ~/ssh/authorized keys But i want

• disable the ability to add or remove ssh-keys (turn off ~/ssh/authorized_keys)
• The user should not be able to rm -f pub_key, modify pub_key wherever it sits in the system
• make the directory where the pub keys for different accounts are stored not readable for "normal" user, e.g. like /etc/sudoers.d/ is only readable by root1

Is that possible? How would i do that?

Answer 1

There are two things that you want to achieve:

• Disallow the authentication using ~/.ssh/authorized_keys

  As proposed set AuthorizedKeysFile to some different place. If there is the discussed requirement, it will not be evaluated (otherwise there is nothing more to solve).

• Set AuthorizedKeysCommand

  The command will return you the authorized keys from your the location of your own choice.

For example:

AuthorizedKeysFile /etc/ssh/%u/authorized_keys
AuthorizedKeysCommand /usr/sbin/get_user_keys
AuthorizedKeysCommandUser dedicated_user

And your script /usr/sbin/get_user_keys might look like:

#!/bin/sh
cat /etc/ssh/%u/authorized_keys

This makes basically the keys read-only and solves your issues.

Answer 2

There's one thing you can do without editing system configuration files to get most of what you want. You'd just use ~user/.ssh/authorized_keys and all the rest like normal and make those immutable.

You can set the ~user/.ssh directory immutable, which prevents moving it or deleting it, which is important if you don't want them to create a new .ssh with their own contents. It also prevents adding, moving, or deleting files within it.

You can set various files (like ~user/.ssh/authorized_keys or ~user/.ssh/id_rsa.pub) immutable, which prevents moving them or deleting them. It also prevents editing them.

Note that immutable directories and files are protected in this way even against their owners. They're even protected in this way against the root user until root removes the immutability.

Make sure to set the permissions for the directories and files properly for privacy before setting them immutable, since immutability blocks even that.

You set something immutable like this:

sudo chattr +i [directory path|file path]

A particularly convenient command protects .ssh and all files within it (recursively if you have subdirectories) in one go:

sudo chattr -R +i ~user/.ssh

To turn off immutability to change something (make sure to turn it back on when you're done):

sudo chattr -i [directory path|file path]

Note that a quick way to be able to edit whatever you want is:

sudo chattr -R -i ~user/.ssh