We need to have ability to store ssh keys outside of config
for that purpose we can create subdir in /config for that purpose
and use sshd configuration
like
AuthorizedKeysFile /config/ssh/%u
The following tokens are defined:
%u is replaced by the username of the user
This one is partially related to T312 but not only
we had some discussions with @dmbaturin in past about keys
and came across idea that it will be great to keep keys outside of config
Actually I like the fact to have the users SSH pub key inside the config. This makes it super handy to just copy/paste a users config entry arround VyOS instances.
Cisco/Ubiquity uses the same approach, User SSH keys are located inside running-config.
That is not something that we need to choose between,
we keep both, but for environments where users comes from AD, LDAP, Radius, etc.