title: SSH-key copy without login
body: <p>I'm faced with the typical problem of having created an ssh key on a client and wanting to update the server's authorized_keys to contain the new client's public key.</p>
  
  <p>From searching the forums I have seen many suggestions to use scp or ssh-copy-id.</p>
  
  <p>However, both of these require login to the server.
  For security reasons, I would prefer not accepting any password login on my server, so I'm looking for a way to communicate the client's public key to the server without login.</p>
  
  <p>So first question: Is there an accepted method for this?</p>
  
  <p>I was thinking about using the SSH_ORIGINAL_COMMAND variable so that the client would do something like</p>
  
  <pre><code>ssh dummy@server `cat mykey.pub`
  </code></pre>
  
  <p>and in the server I would be able to use the logs to see the connection attempt (and failure since the key is unknown) and copy the original command.
  However, I have seen that in /var/log/secure, the connection attempt and failure are logged, but the command sent with it is not.</p>
  
  <p>Which leads to the second question: Is this information logged in any other log?</p>
  
  <p>If not, I had the idea of creating a user (let's say "dummy") on the server who would use its .ssh/authorized_keys to specify a forced command for all login attempts.  I have already seen that doing this gives me indeed access to the SSH_ORIGINAL_COMMAND variable, which I can write to a file somewhere.  The problem here is that I can only specify a forced command for a specific public key... but I would need to do it for <strong>any</strong> key.</p>
  
  <p>So third question: is it possible to specify in authorized_keys a command for <strong>any</strong> key?</p>
  
  <p>If not, my last solution is to indeed accept a password connection for user dummy on the server, but make sure the user cannot do <strong>anything</strong> other than calling my script with an argument (the public key) in order to ensure security. </p>
  
  <p>Is this possible?</p>