Sure, I can do this with /usr/local/sbin/adduser.local, but it would
be nice to move this upstream: an option --ssh-id=/path/to/file
which sets --disabled-password and install the given file as
~newuser/.ssh/authorized_keys.

Hello,

I'd like to work on this bug as my first Debian contribution. Before writing any code I'd like to confirm the intended design, since adduser is a core package and I'd rather not guess.

My understanding of the request:

$ adduser --ssh-id FILE newuser

would imply --disabled-password and install FILE as ~newuser/.ssh/authorized_keys (0600), inside a 0700 ~/.ssh owned by the new user.

Open questions:

1. Option name: --ssh-id as originally requested, or something more explicit like --add-ssh-key / --authorized-keys?
2. Argument: a path to a file only, or should "-" mean stdin, or should a literal key string also be accepted?
3. What should happen when the option is combined with --no-create-home, with a home directory of /nonexistent, or with an already existing home directory? My inclination is to fail early with a clear error rather than silently skip the key.
4. Should the key be validated (e.g. basic syntax check on the key type field), given that adduser must not depend on openssh-client?
5. Should this be exposed in adduser.conf as well, or command line only?
6. Does it make sense for --system users?

Happy to follow whatever direction you prefer, and to write the manpage, the test cases and the changelog entry along with the patch.

Thanks,
Juan Muñoz

Hello Juan,

thanks for trying to tackle this. I'll try to answer your questions.

Probably not, it is a valid usecase to have a password and an ssh-key. A
user wanting no password should probable request that explicitly.

Personally, I'd go for whatever DIR_MODE specifies. There is nothing
more secret in ~/.ssh than in ~. It is probably over the top to
introduce a FILE_MODE variable, as well as unsetting the 1 bit from
DIR_MODE to derive a file mode probably is as well. I'll leave that to
you whatever you feel implementing.


I think that a literal string should be accepted as well, not sure about
- since adduser might be used in a pipe or have other interactive parts.
The FILE should be allowed to contain multiple keys.

How about a non-fatal error about not installing the key?

I think not, the worst that can happen is that the sshd won't accept the
key, failing to the secure side, and I'd probably not want to have
ssh-specific domain knowledge in adduser.

I think command line only, how would adduser decide WHICH key to add if
set in adduser.conf?

Probably not. Debian packages are being pushed towards using
systemd-sysusers anyway, destroying a lot of the work that the adduser
maintainers put into adduser.

That would be appreciated. Don't bother with the changelog, changelog
entries are a pain to rebase and merge, and the changelog is generated
anyway from the git commit messages.

I like small, contained commits, but that's your call as well. Make sure
to start from git debian/latest, not from anything in the archive.

Thanks for contributing.

Greetings
Marc

Hello,

Bug #446362 in adduser reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/debian/adduser/-/commit/2e5dd2685261d2d80c07ccb528b3f0f0468c8d71
------------------------------------------------------------------------
adduser: add --add-authorized-key option

Install SSH public keys from a file or from the command line into the
new user's ~/.ssh/authorized_keys.

Closes: #446362
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/446362

We believe that the bug you reported is fixed in the latest version of
adduser, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 446362@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Marc Haber <mh+debian-packages@zugschlus.de> (supplier of updated adduser package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 28 Aug 2026 17:56:44 +0200
Source: adduser
Architecture: source
Version: 3.159
Distribution: unstable
Urgency: medium
Maintainer: Debian Adduser Developers <adduser@packages.debian.org>
Changed-By: Marc Haber <mh+debian-packages@zugschlus.de>
Closes: 446362 1140472
Changes:
 adduser (3.159) unstable; urgency=medium
 .
   * Fix debian/NEWS typo. Thanks to Daniel Lewart
   * adduser: add --add-authorized-key option.
     Patch by Juan Muñoz, thank you! (Closes: #446362)
   * fix some whitespace and spelling issues.
     Thanks to Dr. Helge Kreutzmann (Closes: #1140472)
Checksums-Sha1:
 f8a0a673476398315338de63cece67bca874f1a9 1206 adduser_3.159.dsc
 defcf078fd98b764ed6ee30c5e2232be67905fdf 373244 adduser_3.159.tar.xz
Checksums-Sha256:
 b8306994d64268b7f1917f390b23d88f4f5ad7c70f210161276d5a718aa1dd7d 1206 adduser_3.159.dsc
 f732ec215661c4f1d36593493852d29fb5b17ebc4e7614730fea47dab2a888cd 373244 adduser_3.159.tar.xz
Files:
 67e10e74726f84bfe7d48b90bce71716 1206 admin important adduser_3.159.dsc
 00cdf1c17ff2f47ab38440051a83c174 373244 admin important adduser_3.159.tar.xz
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRoUtdjQYCq5giMg+rVTTAMN2ORyQUCapHR+QAKCRDVTTAMN2OR
yZIkAQDRUZv4pCmUmLypwNhRS1DOFS+hEMJfBH4CxuZdOLEfTQEA6PQD7URPv/Dr
4ufKS6QY9G/EX2ZutXQnD6NtEaengAE=
=QTDJ
-----END PGP SIGNATURE-----