Re: SSH question

> I hope someone can help with this finding.

You haven't really defined this well.

authorized_keys files go into the .ssh directory of a specific user. So if I wanted the key 'id_rsa.pub' to be allowed to ssh into my account (jdoe) on host 'host-a', I'd do the following

   me@home$ cd ~/.ssh
   me@home$ ls
   id_rsa id_rsa.pub

   me@home$ scp id_rsa.pub jdoe@host-a:mykey.pub    me@home$ ssh jdoe@host-a
   (type password, since the key isn't trusted yet.)

   jdoe@host-a$ mkdir .ssh ; chmod 700 .ssh . ; cd .ssh
   jdoe@host-a$ cat ../mykey.pub >> authorized_keys
   jdoe@host-a$ chmod 600 authorized_keys

   me@home$ ssh jdoe@host-a
   (no password required now.)

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Now, if I take my id_rsa key and copy it to some other machine (say my ISP, or my work machine, etc) then yes, I can use it to log into host-a with pubkey authentication.

If I want to allow this key only from one host, then edit the authorized_keys file and add a 'from=' option, ala

   jdoe@host-a$ head -1 authorized_keys
   from=192.168.1.1 AAAAB3NzaC1yc2EAAAABIwAAAIEAp8Z4Efr8...

> It seems that so long as user1 has a key on any machine, and it exists

The user should only be able to log into an account that has included user1's public key in their authorized_keys file. This user couldn't log in as me if I don't have his pubkey in my authorized_keys file, for example.

If I'm missunderstanding your situation, let me know.

--
Brian Hatch                  Never test the depth
   Systems and                of the water with
   Security Engineer          both feet.
www.buildinglinuxvpns.net

Every message PGP signed