Background: I added OTP token authentication to my web server. I modified the
/etc/ssh/sshd_config file with the
ForceCommand /token/script command.
Problem: I have a local Jenkins instance connecting to the web server for doing deployments; Jenkins can't enter token info or respond to phone calls (although who knows, I bet there's even a plugin for that!).
Possible solution: use the
~/user/authorized_keys command parameter to force the token script on all keys, except for the key being used by jenkins.
Question: How less secure than the global sshd_config approach the authorized_keys approach is? Would you consider it an acceptable trade-off? Is there a better solution (that allows Jenkins to do slave deployments, whilst keeping everyone else locked down with token auth?).
I've tried both approaches and both work like a charm. The second approach I find more practical in terms of deployments, but it raises some sort of internal red flags for me. I don't know if I'm chasing ghosts (with the red flags). Discuss!