Authorizedkeys

Authorized_keys is a file used by OpenSSH to store the public keys of clients permitted to authenticate to a user account using public key authentication. The file resides in the user's home directory under .ssh/authorized_keys (for example /home/alice/.ssh/authorized_keys or /root/.ssh/authorized_keys). Each line represents a single public key and may include an optional options block followed by the key data.

Format and options: A line can begin with an optional options string, then the key type (such as ssh-ed25519, ecdsa-sha2-nistp256, or ssh-rsa), followed by the base64-encoded key and an optional comment. The options string can specify restrictions such as command="...", no-port-forwarding, no-X11-forwarding, or from="host.net". Multiple options may be separated by commas. If present, options must come before the key type and data.

Usage: When a client attempts to authenticate with a private key, the SSH server checks the corresponding public key listed in authorized_keys. If a matching key is found and any restrictions pass, the user is granted access according to the server’s configuration.

Management and security: Keys are managed by editing the authorized_keys file, adding or removing lines as needed. For security, ensure proper permissions: the .ssh directory should be 700 and the authorized_keys file should be 600; the user’s home directory should be protected appropriately. It is common to rely on SSH key-based authentication and disable password authentication to improve security. Use strong key types (ed25519 or rsa with adequate length), rotate keys when access changes, and audit the file regularly for unauthorized entries.