1

For key-based auth users must add their public keys to the ~/.ssh/authorized_keys file. This file can contain a number of keys, one per line. So how the server selects the right key to authenticate a user with?

1

From the source code, it just loops over all keys until a matching key is found:

process_principals(FILE *f, const char *file, struct passwd *pw,
    const struct sshkey_cert *cert)
{
//...

    while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
        /* Always consume entire input */
        if (found_principal)
            continue;
//...
        for (i = 0; i < cert->nprincipals; i++) {
            if (strcmp(cp, cert->principals[i]) == 0) {
                debug3("%s:%lu: matched principal \"%.100s\"",
                    file, linenum, cert->principals[i]);
                if (auth_parse_options(pw, line_opts,
                    file, linenum) != 1)
                    continue;
                found_principal = 1;
                continue;
            }
        }
    }
    return found_principal;
}

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.