> For the complete documentation index, see [llms.txt](https://dmcxblue.gitbook.io/red-team-notes-2-0/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/persistence/t1098-account-manipulation/ssh-authorized-keys.md).

# SSH Authorized Keys

Adversaries may modify the SSH authorized\_keys file to maintain persistence on a victim host. Linux distributions and macOS commonly use key-based authentication to secure the authentication to secure the authentication process of SSH sessions for remote management. The authorized\_keys file in SSH specifies the SSH keys that can be used for logging into the user's home directory under \<user-home>/.ssh/authorized\_keys. Users may edit the system's SSH config file to modify the PubKeyAuthentication and RSAAuthentication to the value "yes" to ensure public key and RSA authentication are enabled. The SSH config file is usually located under /etc/ssh/sshd\_config

This technique works when the PUBLIC key has been allowed in the authorized\_keys file

<figure><img src="/files/n4l9YVucpMi5UTpa2u7B" alt=""><figcaption></figcaption></figure>

Also the sshd\_config file needs to have the PubKeyAuthentication as "YES"

<figure><img src="/files/2lN8uMVi60Ls1b1BJa4r" alt=""><figcaption></figcaption></figure>

When all has been set the malicious actor can steal the private key, or modify the authorized\_keys file to add a new key which allows the attacker to remote onto the workstation via SSH

<figure><img src="/files/a1lbfd67zIjVIxnI0HIK" alt=""><figcaption></figcaption></figure>