I would like to configure OpenSSH 6.2p2 for a service account (we'll call it "serviceacct") with an empty password which does the following:
- First try public key authentication; if it succeeds then run the forced command specified in the authorized_keys file.
- Fall back to empty password authentication and run the forced command specified somewhere else.
Essentially this would give one behavior for known users and another behavior for anonymous users.
In an ideal world, these settings in sshd_config would do what I want:
PubkeyAuthentication yes PasswordAuthentication yes Match User serviceacct PermitEmptyPasswords yes ForceCommand /my/program
But I'm running into a couple of problems:
ForceCommand /my/programoverrides the forced command that is set in the authorized_keys file.
- Using an empty password seems to take precedence over public key authentication.
Is there any way around these two problems, short of modifying the OpenSSH server? One obvious workaround that I can think of is to just use two service accounts - one for known users that only uses public key authentication, and another for anonymous users that only uses empty password authentication. I'm trying to avoid having two user accounts if possible.
Edit - Why I'd like this behavior
I'm building a service which hosts various types of version control system repositories (Subversion, Git, and Mercurial). Think GitHub or Bitbucket, but locally hosted (this is the key, since some of our work cannot leave our site). Arguably, the simplest access method which is common to each of these version control systems is SSH.
Each repository has configurable access rules for known and anonymous users. I'd like to be able to support both known and anonymous users using the same URL for any of the version control systems. Since the user that hosts the repository is part of the URL (e.g.
ssh://user@host/path), having two different users - one for known users and one for anonymous users - would require two different URLs.
There is one technicality that I should clarify: I'm actually using the
AuthorizedKeysCommand directive in sshd_config, which instructs sshd use the output of an external program instead of reading the ~/.ssh/authorized_keys file.
sshdto be publickey only and when an empty password situation happens, detect it on-the-fly, modify
sshd_configaccordingly, do your stuff and in the end reset your
sshd_configto it's original state. Never looked into this kind of detection but I'm assuming you could somehow use your logs to do this. Although I think probably the user would have to initiate another connection then.