Mastering Linux Security and Hardening - Second Edition

Managing SSH keys

Earlier, I showed you how to create a pair of keys on your local workstation, and then transfer the public key to a remote server. This allows you to disable username/password authentication on the server, making it much harder for the bad guys to break in. The only problem with this that we didn't address is that the public key goes into an authorized_keys file that's in the user's own home directory. So, the user can manually add extra keys to the file, which would allow the user to log in from other locations besides the one that's been authorized. And, there's also the problem of having authorized_keys files all over the place, in every user's home directory. That makes it a bit hard to keep track of everyone's keys. ...