Question

I’m running a Mac OS X Leopard Server and I created a new user without designating a home directory for that user. Is it possible to have that user authenticate using a Public Key?

I know that when a user does have a home directory it goes in to ~/.ssh/authorized_keys

I don’t want to create a home directory for this user because my understanding is it would then allow them to login if given physical access.

UPDATE: I need to allow this user to do a Secure FTP connection only. Setting the Login Shell to /bin/false/ will prevent them from connecting remotely as well.

Answer 1

You have to edit /etc/ssh/sshd_config or where it is located on your machine and change the AuthorizedKeysFile setting.

The docs say:

 AuthorizedKeysFile          Specifies the file that contains the public keys that can be used          for user authentication.  AuthorizedKeysFile may contain tokens of          the form %T which are substituted during connection setup.  The fol-          lowing tokens are defined: %% is replaced by a literal '%', %h is          replaced by the home directory of the user being authenticated, and          %u is replaced by the username of that user.  After expansion,          AuthorizedKeysFile is taken to be an absolute path or one relative          to the user's home directory.  The default is          ``.ssh/authorized_keys''. 

But why do you have users (that can login) without a home?