0

Is it possible (and if so, how) to do the following with openssh-server:

  • to be able to authenticate root user with a key and no password
  • to be able to authenticate a non-root user with a key and no password
  • to prevent the non-root user from logging in as root with his/hers own key
  • to do that with a single instance of sshd, using only one TCP port

And yes, I am very much aware of the risks of PermitRootLogin yes option.

Improve this question

1 Answer 1

Reset to default
2

This should work "out the box", and should require nothing further then putting users public keys in their .ssh/authorized_keys file for the corresponding user on the server. (If this file does not exist for the user, make it !)

The only thing to be aware of is that if the non-root user public key is added to the servers root/.ssh/authorized_keys, then that non-root user will be able to log in as root on the server - so to avoid this, just don't add their key to roots authorized_keys file.

You have already come across PermitRootLogin - which, of-course, needs to be enabled on the server. You can (optionally) limit who can log from where (if at all) by adding a line like "AllowUsers [email protected] [email protected] user2" - which will only allow root and user1 from a particular IP address, but user2 can log in from anywhere. You can extend this with as many user/ip combinations as required.

Improve this answer
1
  • Thank you! I didn't notice that, bacause the server was configured a bit weird (a single AuthorizedKeysFile in sshd_config, for all users)
    – Ulrik
    Oct 13, 2017 at 1:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .