I can't figure out what is going on. In theory, I produced a key pair for user user on the machine homedesktop, and sent the public key to myserver.example.com and put it under myserver:~user/.ssh/authorized_keys, I can log-in without a password, no problem.The problem is that weirdly, all other users on the machine homedesktop can also login as user@myserver, without a password! You'd think the key is just accessible globally at homedesktop:/etc/ssh maybe, but it's not (I deleted the directory and tried again, still works). In fact, it's not only myserver, all servers that have the public key of user accept passwordless logins from all users at homedesktop. It looks from the SSH log below as if the key may be in memory? I don't understand what is going on and how to prevent the other users from using this key! Also, homedesktop:~user/.ssh has normal permissions, not readable to other users.In this example, otheruser tries to log in as user@myserver, home come s/he access to the user@homedesktop key, which is accepted? otheruser@homedesktop:~$ rm -rf .sshotheruser@homedesktop:~$ ssh -vvv -p 15555 user@myserver.example.comOpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014debug1: Reading configuration data /etc/ssh/ssh_configdebug1: /etc/ssh/ssh_config line 19: Applying options for *debug2: ssh_connect: needpriv 0debug1: Connecting to myserver.example.com [123.234.123.234] port 15555.debug1: Connection established.debug1: SELinux support disableddebug1: identity file /home/otheruser/.ssh/id_rsa type -1debug1: identity file /home/otheruser/.ssh/id_rsa-cert type -1debug1: identity file /home/otheruser/.ssh/id_dsa type -1debug1: identity file /home/otheruser/.ssh/id_dsa-cert type -1debug1: identity file /home/otheruser/.ssh/id_ecdsa type -1debug1: identity file /home/otheruser/.ssh/id_ecdsa-cert type -1debug1: identity file /home/otheruser/.ssh/id_ed25519 type -1debug1: identity file /home/otheruser/.ssh/id_ed25519-cert type -1debug1: Enabling compatibility mode for protocol 2.0debug1: Local version string SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.6debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3debug1: match: OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.3 pat OpenSSH_6.6.1* compat 0x04000000debug2: fd 3 setting O_NONBLOCKdebug3: put_host_port: [myserver.example.com]:15555debug1: SSH2_MSG_KEXINIT sentdebug1: SSH2_MSG_KEXINIT receiveddebug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1debug2: kex_parse_kexinit: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-rsa-cert-v00@openssh.com,ssh-dss-cert-v00@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,ssh-rsa,ssh-dssdebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.sedebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.sedebug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96debug2: kex_parse_kexinit: none,zlib@openssh.com,zlibdebug2: kex_parse_kexinit: none,zlib@openssh.com,zlibdebug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: kex_parse_kexinit: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1debug2: kex_parse_kexinit: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ssh-ed25519debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.sedebug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.sedebug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96debug2: kex_parse_kexinit: hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96debug2: kex_parse_kexinit: none,zlib@openssh.comdebug2: kex_parse_kexinit: none,zlib@openssh.comdebug2: kex_parse_kexinit: debug2: kex_parse_kexinit: debug2: kex_parse_kexinit: first_kex_follows 0 debug2: kex_parse_kexinit: reserved 0 debug2: mac_setup: setup hmac-md5-etm@openssh.comdebug1: kex: server->client aes128-ctr hmac-md5-etm@openssh.com nonedebug2: mac_setup: setup hmac-md5-etm@openssh.comdebug1: kex: client->server aes128-ctr hmac-md5-etm@openssh.com nonedebug1: sending SSH2_MSG_KEX_ECDH_INITdebug1: expecting SSH2_MSG_KEX_ECDH_REPLYdebug1: Server host key: ECDSA 9d:ce:c8:e4:39:43:f5:3a:0b:11:0b:77:78:cd:63:2fdebug3: put_host_port: [123.234.123.234]:15555debug3: put_host_port: [myserver.example.com]:15555debug1: checking without port identifierThe authenticity of host '[myserver.example.com]:15555 ([123.234.123.234]:15555)' can't be established.ECDSA key fingerprint is 9d:ce:c8:e4:39:43:f5:3a:0b:11:0b:77:78:cd:63:2f.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added '[myserver.example.com]:15555,[123.234.123.234]:15555' (ECDSA) to the list of known hosts.debug1: ssh_ecdsa_verify: signature correctdebug2: kex_derive_keysdebug2: set_newkeys: mode 1debug1: SSH2_MSG_NEWKEYS sentdebug1: expecting SSH2_MSG_NEWKEYSdebug2: set_newkeys: mode 0debug1: SSH2_MSG_NEWKEYS receiveddebug1: SSH2_MSG_SERVICE_REQUEST sentdebug2: service_accept: ssh-userauthdebug1: SSH2_MSG_SERVICE_ACCEPT receiveddebug2: key: user@myserver (0x7fba1acf8000),debug2: key: user@homedesktop (0x7fbaa1bbcf30),debug2: key: /home/otheruser/.ssh/id_rsa ((nil)),debug2: key: /home/otheruser/.ssh/id_dsa ((nil)),debug2: key: /home/otheruser/.ssh/id_ecdsa ((nil)),debug2: key: /home/otheruser/.ssh/id_ed25519 ((nil)),debug1: Authentications that can continue: publickey,passworddebug3: start over, passed a different list publickey,passworddebug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,passworddebug3: authmethod_lookup publickeydebug3: remaining preferred: keyboard-interactive,passworddebug3: authmethod_is_enabled publickeydebug1: Next authentication method: publickeydebug1: Offering RSA public key: user@myserverdebug3: send_pubkey_testdebug2: we sent a publickey packet, wait for replydebug1: Authentications that can continue: publickey,passworddebug1: Offering DSA public key: user@homedesktopdebug3: send_pubkey_testdebug2: we sent a publickey packet, wait for replydebug1: Server accepts key: pkalg ssh-dss blen 433debug2: input_userauth_pk_ok: fp d2:43:29:a0:88:06:a1:d2:1d:7a:65:15:4f:f8:95:ebdebug3: sign_and_send_pubkey: DSA d2:43:29:a0:88:06:a1:d2:1d:7a:65:15:4f:f8:95:ebdebug1: Authentication succeeded (publickey).Authenticated to myserver.example.com ([123.234.123.234]:15555).debug1: channel 0: new [client-session]debug3: ssh_session2_open: channel_new: 0debug2: channel 0: send opendebug1: Requesting no-more-sessions@openssh.comdebug1: Entering interactive session.debug2: callback startdebug2: fd 3 setting TCP_NODELAYdebug3: packet_set_tos: set IP_TOS 0x10debug2: client_session2_setup: id 0debug2: channel 0: request pty-req confirm 1debug1: Sending environment.debug1: Sending env LC_PAPER = en_US.UTF-8debug2: channel 0: request env confirm 0debug3: Ignored env XDG_VTNRdebug3: Ignored env XDG_SESSION_IDdebug3: Ignored env KDE_MULTIHEADdebug1: Sending env LC_ADDRESS = en_US.UTF-8debug2: channel 0: request env confirm 0debug1: Sending env LC_MONETARY = en_US.UTF-8debug2: channel 0: request env confirm 0debug3: Ignored env XDG_GREETER_DATA_DIRdebug3: Ignored env CLUTTER_IM_MODULEdebug3: Ignored env SELINUX_INITdebug3: Ignored env SESSIONdebug3: Ignored env GPG_AGENT_INFOdebug3: Ignored env SHELLdebug3: Ignored env TERMdebug3: Ignored env XDG_SESSION_COOKIEdebug3: Ignored env KONSOLE_DBUS_SERVICEdebug3: Ignored env GTK2_RC_FILESdebug3: Ignored env KONSOLE_PROFILE_NAMEdebug3: Ignored env GS_LIBdebug3: Ignored env GTK_RC_FILESdebug1: Sending env LC_NUMERIC = en_US.UTF-8debug2: channel 0: request env confirm 0debug3: Ignored env WINDOWIDdebug3: Ignored env GNOME_KEYRING_CONTROLdebug3: Ignored env UPSTART_SESSIONdebug3: Ignored env SHELL_SESSION_IDdebug3: Ignored env KDE_FULL_SESSIONdebug3: Ignored env USERdebug1: Sending env LC_TELEPHONE = en_US.UTF-8debug2: channel 0: request env confirm 0debug3: Ignored env LS_COLORSdebug3: Ignored env XDG_SESSION_PATHdebug3: Ignored env XDG_SEAT_PATHdebug3: Ignored env SSH_AUTH_SOCKdebug3: Ignored env DEFAULTS_PATHdebug3: Ignored env SESSION_MANAGERdebug3: Ignored env XDG_CONFIG_DIRSdebug3: Ignored env MAILdebug3: Ignored env PATHdebug3: Ignored env DESKTOP_SESSIONdebug3: Ignored env QT_IM_MODULEdebug1: Sending env LC_IDENTIFICATION = en_US.UTF-8debug2: channel 0: request env confirm 0debug3: Ignored env PWDdebug3: Ignored env JOBdebug3: Ignored env XMODIFIERSdebug3: Ignored env KONSOLE_DBUS_WINDOWdebug3: Ignored env KDE_SESSION_UIDdebug3: Ignored env GNOME_KEYRING_PIDdebug1: Sending env LANG = en_US.UTF-8debug2: channel 0: request env confirm 0debug3: Ignored env GDM_LANGdebug3: Ignored env MANDATORY_PATHdebug1: Sending env LC_MEASUREMENT = en_US.UTF-8debug2: channel 0: request env confirm 0debug3: Ignored env IM_CONFIG_PHASEdebug3: Ignored env KONSOLE_DBUS_SESSIONdebug3: Ignored env GDMSESSIONdebug3: Ignored env SESSIONTYPEdebug3: Ignored env HOMEdebug3: Ignored env XDG_SEATdebug3: Ignored env SHLVLdebug3: Ignored env COLORFGBGdebug3: Ignored env LANGUAGEdebug3: Ignored env KDE_SESSION_VERSIONdebug3: Ignored env XCURSOR_THEMEdebug3: Ignored env UPSTART_INSTANCEdebug3: Ignored env PYTHONPATHdebug3: Ignored env LOGNAMEdebug3: Ignored env UPSTART_EVENTSdebug3: Ignored env XDG_DATA_DIRSdebug3: Ignored env DBUS_SESSION_BUS_ADDRESSdebug3: Ignored env QT4_IM_MODULEdebug3: Ignored env LESSOPENdebug3: Ignored env TEXTDOMAINdebug3: Ignored env UPSTART_JOBdebug3: Ignored env INSTANCEdebug3: Ignored env DISPLAYdebug3: Ignored env XDG_RUNTIME_DIRdebug3: Ignored env PROFILEHOMEdebug3: Ignored env QT_PLUGIN_PATHdebug3: Ignored env GTK_IM_MODULEdebug3: Ignored env XDG_CURRENT_DESKTOPdebug3: Ignored env PAM_KWALLET_LOGINdebug1: Sending env LC_TIME = en_US.UTF-8debug2: channel 0: request env confirm 0debug3: Ignored env LESSCLOSEdebug3: Ignored env TEXTDOMAINDIRdebug1: Sending env LC_NAME = en_US.UTF-8debug2: channel 0: request env confirm 0debug3: Ignored env XAUTHORITYdebug3: Ignored env _debug3: Ignored env OLDPWDdebug2: channel 0: request shell confirm 1debug2: callback donedebug2: channel 0: open confirm rwindow 0 rmax 32768debug2: channel_input_status_confirm: type 99 id 0debug2: PTY allocation request accepted on channel 0debug2: channel 0: rcvd adjust 2097152debug2: channel_input_status_confirm: type 99 id 0debug2: shell request accepted on channel 0Welcome to MYSERVER!!Last login: Tue Nov  1 21:05:47 2016 from 111.222.111.222user@myserver:~$
SSH private key somehow accessible to all users
ssh;key authentication
debug1: Offering DSA public key: user@homedesktopdebug3: send_pubkey_testdebug2: we sent a publickey packet, wait for replydebug1: Server accepts key: pkalg ssh-dss blen 433debug2: input_userauth_pk_ok: fp d2:43:29:a0:88:06:a1:d2:1d:7a:65:15:4f:f8:95:ebdebug3: sign_and_send_pubkey: DSA d2:43:29:a0:88:06:a1:d2:1d:7a:65:15:4f:f8:95:ebdebug1: Authentication succeeded (publickey).Authenticated to myserver.example.com ([123.234.123.234]:15555).Says that the key is stored in your session in your ssh-agent. Running the ssh without the connection to your ssh-agent will not allow you the access:SSH_AUTH_SOCK= ssh -vvv -p 15555 user@myserver.example.comAlso killing the agent will do the job: eval $(ssh-agent -k) (if you are not using gnome-keyring). Otherwise re-login from your DE will flush the key.