I found one article where the mentioned about public key - AUTHORIZED KEY location in ubuntu linux system


When a user tries to log in using key-based authentication, the OpenSSH server looks for authorized keys from a directory specifies in the server configuration using the AuthorizedKeysFile option. The default is .ssh/authorized_keys in the user's home directory.

However, having the authorized keys stored in the user's home directory means that the user can add new keys that authorize logins to his/her account. This is convenient, but the user can then give these keys to friends or colleagues, or even sell them for Bitcoins (this has actually happened). SSH keys are furthermore permanent and remain valid until expressly removed.

If authorized keys are added for root or service accounts, they easily remain valid even after the person who installed them has left the organization. They are also a convenient way for hackers to establish permanent presence on a system if there is no detection and alerts about unauthorized new keys.

For these reasons, most larger organizations want to move authorized keys to a root-owned location and established a controlled provisioning and termination process for them.

I wants to Move SSH key to root Owned Location

Following is standard solution.


In principle, moving SSH keys to a root-owned location is easy:

  1. Create a suitable root-owned directory, e.g., /etc/ssh/keys, under which authorized keys are stored.
  2. Create a subdirectory under this directory for each user, and move each user's authorized_keys file to /etc/ssh/keys//authorized_keys.
  3. Finally, change set AuthorizedKeysFile /etc/ssh/keys/%u/authorized_keys in /etc/ssh/sshd_config.

My question is, in Ubuntu Linux 16.04 EC2 instance

  • if we specify authorized_key location at root level, then does ~/.ssh/authorized_keys will still work ?
  • Will I able to ssh connect with my ec2 instance ?
  • ~/.ssh/authorized_keys will not work if it is not listed in the config file – Panther Aug 2 '18 at 15:39
  • In addition to moving the keys, and making them owned by root, in the environment you describe, you the system administrator, and not your users, should distribute the keys. Dont allow users to upload their own keys – Panther Aug 2 '18 at 16:12

SSH public key files

Yes, the ~/.ssh/authorized_keys will stil work if you specify it in the /etc/ssh/sshd_config. Checkout the sshd_config manpage:

         Specifies the file that contains the public keys that can be used for user
         authentication.  The format is described in the AUTHORIZED_KEYS FILE FORMAT section
         of sshd(8).  AuthorizedKeysFile may contain tokens of the form %T which are
         substituted during connection setup.  The following tokens are defined: %% is
         replaced by a literal '%', %h is replaced by the home directory of the user being
         authenticated, and %u is replaced by the username of that user.  After expansion,
         AuthorizedKeysFile is taken to be an absolute path or one relative to the user's
         home directory.  Multiple files may be listed, separated by whitespace.  Alternately
         this option may be set to “none” to skip checking for user keys in files.  The
         default is “.ssh/authorized_keys .ssh/authorized_keys2”.

But you have to store the keys in a file not a directory.

When changeing the sshd configuration, the current ssh-session will not stop working. So you can change the configuration, restart the sshd and test the new configuration.

# edit the configuration
$ sudo vi /etc/ssh/sshd_config

# restart the sshd
$ sudo systemctl restart sshd.service

# test from your remote hosts
$ ssh -i somenewkey root/user@ec2host

SSH public key from LDAP

A way to mange SSH public keys via a central instance is a LDAP server. This post describes the basic requirements for the authentication to work. There is also some nice scripting to manage the stored public keys. The major disadvantage is, that you setup and manage LDAP server (with encryption, certificates, etc), that is als reachable from all your VM or container instances.

  • But keeping ~/.ssh/authorized_keys in the config defeats the whole purpose of the question. – Panther Aug 2 '18 at 16:10

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.