Originally Posted by hz36t5

It appears that by default the location that SFTP uses to look for the users keys for protocol version 1 is ~/.ssh/identity; and ~/.ssh/id_rsa or ~/.ssh/id_dsa for protocol version 2. Is there a setting in the etc/ssh/sshd_config that can be configured to change this location for all users?

Originally Posted by TB0ne

Read the man page on sshd_config, or the documentation on setting up openssh. The AuthorizedKeysFile directive is what you're looking for.

Neither is a good idea for security purposes.

Then why have separate users at all, if you want everyone to read/write to the same directory? Not much point in separate users, then. You can chroot sftp (there are how-to guides), but that typically jails users to their own home directories.

"For traceability of users login/actions while connected."

Read the "Question Guidelines" link in my posting signature. We're happy to help, but please do basic research first; and since you're using RHEL, have you contacted Red Hat support for guidance? You are PAYING FOR RHEL, RIGHT????

Originally Posted by TB0ne

Then why have separate users at all, if you want everyone to read/write to the same directory? Not much point in separate users,

Originally Posted by Medievalist

Having separate users using the same resources allows you to revoke access to individuals without disabling everyone else. However, if they all use the same ssh key as access credentials, you're right, it's completely pointless.



I haven't seen any real clean implementations that allow strong logging. For example Red Hat EL7's rsyslog can't manage more than a small number of logging sockets, so you can't have one in each chroot, and have to pass logging traffic through some less secure method or put logs in files that are available inside the chroot.

Originally Posted by hz36t5

I don't want them all to have the same ssh key. I want each user to continue to have a separate ssh key. I just want all of the keys in the same directory. Or, if it is possible the continue to have all of the users ssh keys in separate directories, but everyone have the same home directory. Does that make sense? At then end of the day, I want all users to log in using their ssh keys but everyone have the same home dir.

Originally Posted by hz36t5

"Currently using RHEL Ent 7 trial which has ended."

Originally Posted by TB0ne

Again, you can put the keys anywhere you'd like, as per the directive given to you earlier. However, you are now going to add complexity to how someone connects, and your system is going to be harder to administer. Because if you have one 'home directory' for all of these users, the keys are going to have to have separate names. so id_rsa will have to be named uniquely for each user, like "pjones_id_rsa", etc. Then they will have to connect by specifying which key file, like "ssh user@server -i /home/dir/.ssh/pjones_id_rsa".

And you're STILL going to wind up with a security hole; because EVERY USER will have to have read access to the keyfile location. So what is to stop them from copying ALL OF THEM to their own system, and doing whatever they want with them?

Think about what you're doing, and about a better way of doing it. Create a directory somewhere, that is JUST for SFTP. Then create a symlink to that directory, in everyones home directory, and chroot SFTP users to their own homes. Key management is easy, security is easy, and everyone can read/write to the one directory you're interested in.


Then you need to PAY FOR RHEL, or stop where you are and load CentOS. Not paying for RHEL is an incredibly bad move if you're going into production, because you WILL NOT get patches/security updates/bugfixes, or anything else. Your system will get insecure and unstable, pretty quick. And you won't be able to load new software as easily, since you won't have access to online repositories. Pay for RHEL, or use CentOS.

Originally Posted by hz36t5

Going to try the symlink route instead.
This is a development. We will have a paid license for red hat in prod.

Originally Posted by hz36t5

I don't want them all to have the same ssh key. I want each user to continue to have a separate ssh key. I just want all of the keys in the same directory. Or, if it is possible the continue to have all of the users ssh keys in separate directories, but everyone have the same home directory. Does that make sense? At then end of the day, I want all users to log in using their ssh keys but everyone have the same home dir.