Key-Only Access & Restrictions

~12 min · authorized_keys, key-restrictions, from, command

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

authorized_keys is your guest list

With password auth off, ~/.ssh/authorized_keys on each server is the entire access policy — every line is a key allowed in. Treat it like a guest list: every entry should be identifiable, every entry should be auditable, and revocation should be a one-line edit.

Per-key restrictions — the underused power

You can prepend options to individual entries to constrain what a key can do: lock to a source IP range, force a specific command, disable port forwarding, no PTY allocation. Useful for backup keys ("this key can only run rsync"), CI keys ("only from this IP, only run this script"), and similar least-privilege patterns.

Code

Audit the guest list·bash

# Look at every entry
cat ~/.ssh/authorized_keys
# Each line:
#   ssh-ed25519 AAAA...abc you_username@macbook-2024
#   ssh-ed25519 AAAA...def you_username@office-mac-studio
#   ssh-ed25519 AAAA...ghi you_username@retired-laptop  ← revoke me

# Show fingerprint for every line — much easier audit
ssh-keygen -l -f ~/.ssh/authorized_keys

# Revoke a single device by comment
sed -i.bak '/retired-laptop/d' ~/.ssh/authorized_keys

Per-key restrictions (prepended to the line)·bash

# Restrict to a specific source CIDR
from="192.168.1.0/24" ssh-ed25519 AAAA...xyz lan-only

# Force a single command (key can only ever run this)
command="/usr/local/bin/rsync-receiver",no-pty,no-port-forwarding \
  ssh-ed25519 AAAA...xyz backup-key

# Combine — CI key, IP-restricted, command-locked, no shell
from="203.0.113.0/24",command="/usr/local/bin/deploy.sh",no-pty,no-X11-forwarding,no-agent-forwarding \
  ssh-ed25519 AAAA...xyz ci-deploy-key

External links

OpenSSH sshd authorized_keys

Exercise

On any server you SSH into, run ssh-keygen -l -f ~/.ssh/authorized_keys. Walk down the list. Can you identify every key by comment? Any anonymous lines or stale device names? Either remove or re-comment them. For any backup-style key, add command=...,no-pty,no-port-forwarding to scope what the key can do.

Progress

Progress is local-only — sign in to sync across devices.

← PreviousDisable Password Authentication Next →Fail2ban — Auto-Block Brute Force

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.