2

I have to create a webapp (Apache/PHP) which act as a webportal for people who need to connect via SSH on severals servers. One just go to the portal, authentify himself, and ask to open SSH access. From now, he can connect with his favorite SSH client, and can stop the session on the webapp. All servers are Debian Lenny or Squeeze, and we already connect to them throught a SSH proxy. On this proxy, there is a file /etc/ssh/sshd_config

AllowUsers [email protected].* [email protected].* 
AllowUsers [email protected].*

How can I allow or disallow a user from my webapp? An easier way than rewriting this file and restarting opensshd?

1
  • We have found a way to do it via PAM wich allow to call a script, and the script answer is the user have the right to connect. We are trying to implement the whole thing. May 21, 2012 at 12:06

1 Answer 1

3

Instead of AllowUsers, use something like AllowGroups sshaccess.

Then you can have your web app add that user to the sshaccess group and they'll be able to authenticate. This won't require you to bounce sshd with each change like it would with AllowUsers.

You'll get bonus points for implementing LDAP for authentication - this both makes it very easy to programmatically manage users and groups as well as allowing you to maintain one central user database that multiple servers can refer to.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .