Hello Juan,
thanks for trying to tackle this. I'll try to answer your questions.
On Mon, Aug 17, 2026 at 10:57:12PM +0000, Juan Muñoz wrote:
I'd like to work on this bug as my first Debian contribution. Before
writing any code I'd like to confirm the intended design, since adduser
is a core package and I'd rather not guess.
My understanding of the request:
$ adduser --ssh-id FILE newuser
would imply --disabled-password
Probably not, it is a valid usecase to have a password and an ssh-key. A
user wanting no password should probable request that explicitly.
and install FILE as
~newuser/.ssh/authorized_keys (0600), inside a 0700 ~/.ssh owned by the
new user.
Personally, I'd go for whatever DIR_MODE specifies. There is nothing
more secret in ~/.ssh than in ~. It is probably over the top to
introduce a FILE_MODE variable, as well as unsetting the 1 bit from
DIR_MODE to derive a file mode probably is as well. I'll leave that to
you whatever you feel implementing.
Open questions:
1. Option name: --ssh-id as originally requested, or something more
explicit like --add-ssh-key / --authorized-keys?
--add-authorized-key, maybe?
2. Argument: a path to a file only, or should "-" mean stdin, or should
a literal key string also be accepted?
I think that a literal string should be accepted as well, not sure about
- since adduser might be used in a pipe or have other interactive parts.
The FILE should be allowed to contain multiple keys.
3. What should happen when the option is combined with
--no-create-home, with a home directory of /nonexistent, or with an
already existing home directory? My inclination is to fail early with a
clear error rather than silently skip the key.
How about a non-fatal error about not installing the key?
4. Should the key be validated (e.g. basic syntax check on the key type
field), given that adduser must not depend on openssh-client?
I think not, the worst that can happen is that the sshd won't accept the
key, failing to the secure side, and I'd probably not want to have
ssh-specific domain knowledge in adduser.
5. Should this be exposed in adduser.conf as well, or command line
only?
I think command line only, how would adduser decide WHICH key to add if
set in adduser.conf?
6. Does it make sense for --system users?
Probably not. Debian packages are being pushed towards using
systemd-sysusers anyway, destroying a lot of the work that the adduser
maintainers put into adduser.
Happy to follow whatever direction you prefer, and to write the
manpage, the test cases and the changelog entry along with the patch.
That would be appreciated. Don't bother with the changelog, changelog
entries are a pain to rebase and merge, and the changelog is generated
anyway from the git commit messages.
I like small, contained commits, but that's your call as well. Make sure
to start from git debian/latest, not from anything in the archive.
Thanks for contributing.
Greetings
Marc
--
-----------------------------------------------------------------------------
Marc Haber | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421
