14

I am trying to add a public key to a server but I don't want to restart the sshd service for it to take effect. The reason is that restarting the ssh service seems to be disruptive for other users who could use the ssh service at that time. Most documentation suggest to add a public key to $HOME/.ssh/authorized_keys and then to restart the sshd service (systemctl restart sshd). The OS of interest is Linux.

My questions are:

  1. Is the restart of sshd needed?
  2. If sshd is restarted, is there a service outage at that time?
  3. Is there a way to set up passwordless auth using ssh without needing to restart the sshd service after adding new public keys to $HOME/.ssh/authorized_keys?
user1952500
  • 293
  • 1
  • 3
  • 7
  • @Fox do you mean that only at the point of time when public key auth is enabled a reload is needed, or do you mean that the public key auth need not be enabled? – user1952500 Jan 26 '18 at 05:27
  • 1
    "Most documentation suggest to add a public key to $HOME/.ssh/authorized_keys and then to restart the sshd service" ... I don't think I have ever seen anybody suggest restarting SSH just for adding something to authorized_keys. Please show an example of this. Note that any user can be reasonably expected to have the right to edit their own authorized keys; its simply unreasonable to expect that $RANDOM_USER would have to ask an admin to restart sshd for any tiny change in their keys. – Olorin Jan 26 '18 at 05:30
  • @Olorin sorry I may be wrong. Most documentation talks about ssh setup from the start and they talk about adding the configuration and authorized_keys and then restarting the service. I have not yet seen a message with only addition into authorized_keys. – user1952500 Jan 26 '18 at 05:32

2 Answers2

21

Is the restart of sshd needed?

Not usually. Linux distributions usually ship with a default configuration that allows public key authentication, so you usually don't even have to edit configuration to enable it, and so restarting is unnecessary. Even in the case that you had to do something with sshd_config, you'd only have to restart it only once after editing that file, not for each edit after of the authorized keys file.

Note that you don't even have to restart sshd. From man sshd:

sshd rereads its configuration file when it receives a hangup signal, SIGHUP, by executing itself with the name and options it was started with, e.g. /usr/sbin/sshd.

And the typical systemd service for sshd recognizes this, so you can do systemctl reload sshd instead.

If sshd is restarted, is there a service outage at that time?

Depends on your definition of service outage. A simple restart of sshd will not kill existing ssh connections, but new connections wouldn't be accepted until sshd finishes restarting.

Olorin
  • 4,636
  • 1
  • 13
  • 25
2

The best way is to use

ssh-copyid [email protected]

Where N is the IP address

OR 

ssh-copyid user@fqdn

where fqdn is the Fully Qualified Domain Name (eg server.domain.com)

This does not require any daemon restarts

CRTLBREAK
  • 87
  • 1
  • 2