www文件夹中的.ssh / authorized_keys文件

Question

I created a user to login via SSH without a password, whose user's directory is the /var/www/html folder so i have the ssh/authorized_keys in the same folder. Is that a security problem?

Answer 1

It's not really a security concern, as a public half of a key pair is just that. You can limit some of the security paranoia if you so wish (and if your web server is apache) with a Directory setting. To block access to the sshd directory add (either in your apache config file, or in a .htaccess file):

<Directory /var/www/html/.ssh>
    Order Deny,Allow
    Deny from All
 </Directory>

Although your passphrase is empty, you still require your private key to gain access (it is that half of the key pair you have to keep secure and away from public access). Again if you still feel like donning a tin foil hat, editing your authorized_keys and locking the key down to an IP (if the places you connect from are from static IPs):

from="myhost.ip.address" ssh-rsa AAA....{etc}

may also help you sleep better of a night time :)

Or you may want to take some bedtime reading on wikipedia of the ins-and-outs of public-key encryption:

http://en.wikipedia.org/wiki/Public-key_cryptography

and that may get you off to sleep quicker!