5

I would like to place an SSH public key somewhere onto /boot/ on my Raspbian buster image on SD card, and require SSH access via keys instead of via username and password.

I've added the "ssh.txt" file to boot, and my Raspberry Pi is enabling ssh access during boot, but it still requires password login.

After booting the first time, I can add a key to authorized_keys, but I'd like to do this before boot, so that I never have to do a password login. I'd also like to disable password login entirely.

Improve this question
4
  • You COULD always write something, but you would need to customise the image. I don't understand WHY you would want to do this - I only install a new image every 2 years or so when a new release comes out.
    – Milliways
    Commented May 15, 2020 at 1:29
  • I'm preconfiguring devices for remote deployment in other countries. I to minimize post-deployment work.
    – efitz
    Commented May 15, 2020 at 1:30
  • The easiest way would be to make your own customised image. It isn't that hard to loop mount an image and modify it.
    – Milliways
    Commented May 15, 2020 at 1:32
  • and then a fairly simple change to /lib/systemd/system/sshswitch.service to copy (or append) /boot/ssh.txt to /home/pi/.ssh/authorized_keys
    – Jaromanda X
    Commented May 15, 2020 at 1:41

2 Answers 2

Reset to default
5

Raspbian is installed on two partitions: a fat32 boot partition for kernel and firmware and an ext4 partition for the root filesystem. To disable password authentication and only use public/private keys you always have to modify files on the ext4 filesystem at least one time. The ext4 filesystem is not readable by MS Windows or by iOS without additional helpers. If you want to modify files on the root filesystem before booting the RasPi you have to use a Unix like operating system. Because you want to preconfigure some RasPis you may consider to use just one of them for configuration if you do not have a device available with a Linux like operating system.

To disable password authentication you have to set

PasswordAuthentication no

in /etc/ssh/sshd_config on the root filesystem and copy at least the ssh public key to /home/pi/.ssh/authorized_keys.

You may consider to do it only one time and take an image of this installation. Then you can just flash it to other SD Cards. But this has the disadvantage that all clones have the same ssh server key and you will get error messages and warnings from the ssh client of dubious server connections. You have to generate new server keys with:

~$ sudo rm -v /etc/ssh/ssh_host_*
~$ sudo dpkg-reconfigure openssh-server
~$ sudo systemctl restart sshd.service

But this can be done with a script on first boot up of the cloned RasPi.

Improve this answer
1
  • Thank you very much for the detailed answer! I'll use a Linux host to make the necessary changes to the ext4 file system. I really appreciate the extra tip about re-keying if I clone the SD card; I had thought of doing that but didn't anticipate the complication.
    – efitz
    Commented May 16, 2020 at 4:05
2

Another way would be to edit your cmdline.txt on the boot drive, which is fat32 formatted, and thus editable from Mac and Windows.

In there you could then have init=/path/to/my/script, and said script would be executed for you as the device boots.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.