diff -uprk.orig openssh-3.6.1p1.orig/auth2-pubkey.c openssh-3.6.1p1/auth2-pubkey.c

--- openssh-3.6.1p1.orig/auth2-pubkey.c	2002-06-07 00:27:56 +0400

+++ openssh-3.6.1p1/auth2-pubkey.c	2003-04-11 19:33:27 +0400

@@ -257,8 +257,8 @@ user_key_allowed2(struct passwd *pw, Key

 }

 /* check whether given key is in .ssh/authorized_keys* */

-int

-user_key_allowed(struct passwd *pw, Key *key)

+static int

+user_user_key_allowed(struct passwd *pw, Key *key)

 {

 	int success;

 	char *file;

@@ -276,6 +276,60 @@ user_key_allowed(struct passwd *pw, Key 

 	return success;

 }

+/* check whether given key is in /etc/openssh/authorized_keys* */

+static int

+user_system_key_allowed(struct passwd *pw, Key *key, int *found)

+{

+	int success = 0;

+	char *file;

+	struct stat st;

+

+	*found = 0;

+	file = authorized_keys_system_file(pw);

+	debug("checking public key system file %s", file);

+	if (stat(file, &st) == 0) {

+		*found = 1;

+		success = user_key_allowed2(pw, key, file);

+		xfree(file);

+		if (success)

+			return success;

+	} else

+		xfree(file);

+

+	/* try suffix "2" for backward compat, too */

+	file = authorized_keys_system_file2(pw);

+	debug("checking public key system file2 %s", file);

+	if (stat(file, &st) == 0) {

+		*found = 1;

+		success = user_key_allowed2(pw, key, file);

+		xfree(file);

+		return success;

+	}

+	xfree(file);

+

+	return success;

+}

+

+/*

+ * check whether given key is in /etc/openssh/authorized_keys*

+ * if not found, check whether given key is in .ssh/authorized_keys*

+ */

+int

+user_key_allowed(struct passwd *pw, Key *key)

+{

+	int found, success;

+

+	/* no user given */

+	if (!pw)

+		return 0;

+

+	success = user_system_key_allowed(pw, key, &found);

+	if (!found)

+		success = user_user_key_allowed(pw, key);

+

+	return success;

+}

+

 Authmethod method_pubkey = {

 	"publickey",

 	userauth_pubkey,

diff -uprk.orig openssh-3.6.1p1.orig/auth.c openssh-3.6.1p1/auth.c

--- openssh-3.6.1p1.orig/auth.c	2003-04-11 19:33:10 +0400

+++ openssh-3.6.1p1/auth.c	2003-04-11 19:33:27 +0400

@@ -360,6 +360,18 @@ expand_filename(const char *filename, st

 }

 char *

+authorized_keys_system_file(struct passwd *pw)

+{

+	return expand_filename(options.authorized_keys_system_file, pw);

+}

+

+char *

+authorized_keys_system_file2(struct passwd *pw)

+{

+	return expand_filename(options.authorized_keys_system_file2, pw);

+}

+

+char *

 authorized_keys_file(struct passwd *pw)

 {

 	return expand_filename(options.authorized_keys_file, pw);

diff -uprk.orig openssh-3.6.1p1.orig/auth.h openssh-3.6.1p1/auth.h

--- openssh-3.6.1p1.orig/auth.h	2002-09-27 07:26:01 +0400

+++ openssh-3.6.1p1/auth.h	2003-04-11 19:33:27 +0400

@@ -163,6 +163,8 @@ int	verify_response(Authctxt *, const ch

 struct passwd * auth_get_user(void);

 char	*expand_filename(const char *, struct passwd *);

+char	*authorized_keys_system_file(struct passwd *);

+char	*authorized_keys_system_file2(struct passwd *);

 char	*authorized_keys_file(struct passwd *);

 char	*authorized_keys_file2(struct passwd *);

diff -uprk.orig openssh-3.6.1p1.orig/auth-rsa.c openssh-3.6.1p1/auth-rsa.c

--- openssh-3.6.1p1.orig/auth-rsa.c	2002-06-11 19:47:42 +0400

+++ openssh-3.6.1p1/auth-rsa.c	2003-04-11 19:33:27 +0400

@@ -165,15 +165,21 @@ auth_rsa_key_allowed(struct passwd *pw, 

 	temporarily_use_uid(pw);

 	/* The authorized keys. */

-	file = authorized_keys_file(pw);

-	debug("trying public RSA key file %s", file);

+	file = authorized_keys_system_file(pw);

+	debug("trying public RSA key system file %s", file);

-	/* Fail quietly if file does not exist */

 	if (stat(file, &st) < 0) {

-		/* Restore the privileged uid. */

-		restore_uid();

 		xfree(file);

-		return (0);

+		file = authorized_keys_file(pw);

+		debug("trying public RSA key user file %s", file);

+

+		/* Fail quietly if file does not exist */

+		if (stat(file, &st) < 0) {

+			/* Restore the privileged uid. */

+			restore_uid();

+			xfree(file);

+			return (0);

+		}

 	}

 	/* Open the file containing the authorized keys. */

 	f = fopen(file, "r");

diff -uprk.orig openssh-3.6.1p1.orig/pathnames.h openssh-3.6.1p1/pathnames.h

--- openssh-3.6.1p1.orig/pathnames.h	2002-06-06 23:57:34 +0400

+++ openssh-3.6.1p1/pathnames.h	2003-04-11 19:33:27 +0400

@@ -92,9 +92,11 @@

  * may need to be world-readable.  (This file is read by the daemon which is

  * running as root.)

  */

+#define _PATH_SSH_SYSTEM_PERMITTED_KEYS	SSHDIR "/authorized_keys/%u"

 #define _PATH_SSH_USER_PERMITTED_KEYS	".ssh/authorized_keys"

 /* backward compat for protocol v2 */

+#define _PATH_SSH_SYSTEM_PERMITTED_KEYS2	SSHDIR "/authorized_keys2/%u"

 #define _PATH_SSH_USER_PERMITTED_KEYS2	".ssh/authorized_keys2"

 /*

diff -uprk.orig openssh-3.6.1p1.orig/servconf.c openssh-3.6.1p1/servconf.c

--- openssh-3.6.1p1.orig/servconf.c	2003-04-11 19:33:10 +0400

+++ openssh-3.6.1p1/servconf.c	2003-04-11 19:33:27 +0400

@@ -121,6 +121,8 @@ initialize_server_options(ServerOptions 

 	options->verify_reverse_mapping = -1;

 	options->client_alive_interval = -1;

 	options->client_alive_count_max = -1;

+	options->authorized_keys_system_file = NULL;

+	options->authorized_keys_system_file2 = NULL;

 	options->authorized_keys_file = NULL;

 	options->authorized_keys_file2 = NULL;

@@ -246,6 +248,15 @@ fill_default_server_options(ServerOption

 		options->client_alive_interval = 0;

 	if (options->client_alive_count_max == -1)

 		options->client_alive_count_max = 3;

+	if (options->authorized_keys_system_file2 == NULL) {

+		/* authorized_keys_system_file2 falls back to authorized_keys_system_file */

+		if (options->authorized_keys_system_file != NULL)

+			options->authorized_keys_system_file2 = options->authorized_keys_system_file;

+		else

+			options->authorized_keys_system_file2 = _PATH_SSH_SYSTEM_PERMITTED_KEYS2;

+	}

+	if (options->authorized_keys_system_file == NULL)

+		options->authorized_keys_system_file = _PATH_SSH_SYSTEM_PERMITTED_KEYS;

 	if (options->authorized_keys_file2 == NULL) {

 		/* authorized_keys_file2 falls back to authorized_keys_file */

 		if (options->authorized_keys_file != NULL)

@@ -301,6 +312,7 @@ typedef enum {

 	sBanner, sVerifyReverseMapping, sHostbasedAuthentication,

 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,

 	sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2,

+	sAuthorizedKeysSystemFile, sAuthorizedKeysSystemFile2,

 	sUsePrivilegeSeparation,

 	sDeprecated

 } ServerOpCodes;

@@ -377,6 +389,8 @@ static struct {

 	{ "reversemappingcheck", sVerifyReverseMapping },

 	{ "clientaliveinterval", sClientAliveInterval },

 	{ "clientalivecountmax", sClientAliveCountMax },

+	{ "authorizedkeyssystemfile", sAuthorizedKeysSystemFile },

+	{ "authorizedkeyssystemfile2", sAuthorizedKeysSystemFile2 },

 	{ "authorizedkeysfile", sAuthorizedKeysFile },

 	{ "authorizedkeysfile2", sAuthorizedKeysFile2 },

 	{ "useprivilegeseparation", sUsePrivilegeSeparation},

@@ -894,6 +908,13 @@ parse_flag:

 	 *

 	 * AuthorizedKeysFile	/etc/ssh_keys/%u

 	 */

+	case sAuthorizedKeysSystemFile:

+	case sAuthorizedKeysSystemFile2:

+		charptr = (opcode == sAuthorizedKeysSystemFile ) ?

+		    &options->authorized_keys_system_file :

+		    &options->authorized_keys_system_file2;

+		goto parse_filename;

+

 	case sAuthorizedKeysFile:

 	case sAuthorizedKeysFile2:

 		charptr = (opcode == sAuthorizedKeysFile ) ?

diff -uprk.orig openssh-3.6.1p1.orig/servconf.h openssh-3.6.1p1/servconf.h

--- openssh-3.6.1p1.orig/servconf.h	2002-08-01 05:28:39 +0400

+++ openssh-3.6.1p1/servconf.h	2003-04-11 19:33:27 +0400

@@ -129,6 +129,8 @@ typedef struct {

 					 * disconnect the session

 					 */

+	char   *authorized_keys_system_file;	/* File containing system public keys */

+	char   *authorized_keys_system_file2;

 	char   *authorized_keys_file;	/* File containing public keys */

 	char   *authorized_keys_file2;

 	int	pam_authentication_via_kbd_int;

diff -uprk.orig openssh-3.6.1p1.orig/sshd_config.5 openssh-3.6.1p1/sshd_config.5

--- openssh-3.6.1p1.orig/sshd_config.5	2003-04-01 15:42:14 +0400

+++ openssh-3.6.1p1/sshd_config.5	2003-04-11 19:33:27 +0400

@@ -116,6 +116,23 @@ is taken to be an absolute path or one r

 directory.

 The default is

 .Dq .ssh/authorized_keys .

+.It Cm AuthorizedKeysSystemFile

+Specifies the file that contains the public keys that can be used

+for user authentication.

+.Cm AuthorizedKeysSystemFile

+may contain tokens of the form %T which are substituted during connection

+set-up. The following tokens are defined: %% is replaced by a literal '%',

+%h is replaced by the home directory of the user being authenticated and

+%u is replaced by the username of that user.

+After expansion,

+.Cm AuthorizedKeysSystemFile

+is taken to be an absolute path or one relative to the user's home

+directory.

+If that file exists, it will be tried before

+.Cm AuthorizedKeysFile

+file.

+The default is

+.Dq /etc/openssh/authorized_keys/%u .

 .It Cm Banner

 In some jurisdictions, sending a warning message before authentication

 may be relevant for getting legal protection.