I would like to place an SSH public key somewhere onto /boot/ on my Raspbian buster image on SD card, and require SSH access via keys instead of via username and password.

I've added the "ssh.txt" file to boot, and my Raspberry Pi is enabling ssh access during boot, but it still requires password login.

After booting the first time, I can add a key to authorized_keys, but I'd like to do this before boot, so that I never have to do a password login. I'd also like to disable password login entirely.

  • You COULD always write something, but you would need to customise the image. I don't understand WHY you would want to do this - I only install a new image every 2 years or so when a new release comes out.
    – Milliways
    May 15 '20 at 1:29
  • I'm preconfiguring devices for remote deployment in other countries. I to minimize post-deployment work.
    – Eric
    May 15 '20 at 1:30
  • The easiest way would be to make your own customised image. It isn't that hard to loop mount an image and modify it.
    – Milliways
    May 15 '20 at 1:32
  • and then a fairly simple change to /lib/systemd/system/sshswitch.service to copy (or append) /boot/ssh.txt to /home/pi/.ssh/authorized_keys May 15 '20 at 1:41
  • Thank you very much for the tips, guys!
    – Eric
    May 16 '20 at 4:06

Raspbian is installed on two partitions: a fat32 boot partition for kernel and firmware and an ext4 partition for the root filesystem. To disable password authentication and only use public/private keys you always have to modify files on the ext4 filesystem at least one time. The ext4 filesystem is not readable by MS Windows or by iOS without additional helpers. If you want to modify files on the root filesystem before booting the RasPi you have to use a Unix like operating system. Because you want to preconfigure some RasPis you may consider to use just one of them for configuration if you do not have a device available with a Linux like operating system.

To disable password authentication you have to set

PasswordAuthentication no

in /etc/ssh/sshd_config on the root filesystem and copy at least the ssh public key to /home/pi/.ssh/authorized_keys.

You may consider to do it only one time and take an image of this installation. Then you can just flash it to other SD Cards. But this has the disadvantage that all clones have the same ssh server key and you will get error messages and warnings from the ssh client of dubious server connections. You have to generate new server keys with:

~$ sudo rm -v /etc/ssh/ssh_host_*
~$ sudo dpkg-reconfigure openssh-server
~$ sudo systemctl restart sshd.service

But this can be done with a script on first boot up of the cloned RasPi.

  • Thank you very much for the detailed answer! I'll use a Linux host to make the necessary changes to the ext4 file system. I really appreciate the extra tip about re-keying if I clone the SD card; I had thought of doing that but didn't anticipate the complication.
    – Eric
    May 16 '20 at 4:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.