Daniel Roberson
  • Posts
  • About
  • Notes
  • Projects
  • Time
  • Posts
    About
    Notes
    Projects
    Time

authorized_keys

0001-01-01

The authorized_keys file specifies the SSH keys that can be used to login to the user of which the file is configured.

This is typically found in each user’s home directory under the .ssh directory: ~/.ssh/authorized_keys. This can be configured using the AuthorizedKeysFile setting in sshd_config.

A deprecated feature of OpenSSH is the authorized_keys2 file. Even though this feature is deprecated, placing keys in ~/ssh/.authorized_keys2 may still work.

https://serverfault.com/questions/116177/whats-the-difference-between-authorized-keys-and-authorized-keys2 https://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2


Links to this note

  • borges2021
  • stealthshell-petrich2024
  • Skidmap malware
  • SSH key persistence

Recent Posts

Linux Persistence: Modular Software

2025-04-17 DFIR CTF persistence linux persistence apache asterisk

Linux Persistence: Web Shells

2025-04-16 DFIR persistence webshell linux persistence webshell apache nginx PHP

Linux Persistence: Rootkits

2025-04-15 DFIR persistence rootkit LKM linux persistence LKM rootkit LD_PRELOAD kprobe ftrace ld.so hooking

Linux Persistence: Processes

2025-04-11 DFIR persistence processes linux persistence processes

Defanging Linux LKM Rootkits With cleanup_module()

2025-04-05 Linux LKM rootkits EDR hooks incident response Linux LKM rootkit


Home

About

Notes

Projects

Time

© All rights reserved. Powered by Hugo and Erblog.