1

For key-based auth users must add their public keys to the ~/.ssh/authorized_keys file. This file can contain a number of keys, one per line. So how the server selects the right key to authenticate a user with?

1

From the source code, it just loops over all keys until a matching key is found:

process_principals(FILE *f, const char *file, struct passwd *pw,
    const struct sshkey_cert *cert)
{
//...

    while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
        /* Always consume entire input */
        if (found_principal)
            continue;
//...
        for (i = 0; i < cert->nprincipals; i++) {
            if (strcmp(cp, cert->principals[i]) == 0) {
                debug3("%s:%lu: matched principal \"%.100s\"",
                    file, linenum, cert->principals[i]);
                if (auth_parse_options(pw, line_opts,
                    file, linenum) != 1)
                    continue;
                found_principal = 1;
                continue;
            }
        }
    }
    return found_principal;
}

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.