I'm trying to set up the following: Allow access to an OpenSSH sftp server via ssh keys only, i.e. no password authentication allowed. SSH keys are generated automatically on the server. The server is intended to be used as a web-hosting server, with one user per website. Only sftp access is allowed for these users, no shell.
In order for new users to be able to retrieve their keys via sftp, we allow them to login by password the first time (only the first time!). The password is sent by SMS and each new user has a limited time to connect and get the keys. After the first successful connection, the password access is disabled and only key-based access is allowed for that user.
I have already configured all steps of this workflow except one: how do I detect when a new user connects for the first time via sftp? Is there any elegant method other than parsing the logs?