Determine which key is successfully used for authentication with AuthorizedKeyCommands

Question

As of OpenSSH 6.2, the option to use an external program for key pair based authentication is available with AuthorizedKeysCommand.

According to the sshd_config man page, this program should return zero or more lines of authorized_keys output.

Assuming the configured program returns multiple keys, is there a way (downstream in, say, the ForceCommand) to determine which of the returned keys was used to authenticate?

For example, this works great if you have a separate user for each key. However, if you're sharing a user (i.e. 'git') and you want to use a daemon wide ForceCommand (configured in the sshd_config), you lose the context of which externally identified user and which key was used to authenticate.

Gitlab (and Gitosis) does something similar where it shares a 'git' user but maintains the authorized_keys file to associate a key_id command line argument with their command= option that allows them to then externally determine permissions. This appears to be how they link the key authentication with the force command.

This solution works great on a smaller scale, but seems like a nightmare to scale to many millions of users that, say, Github has.

Do large scale, highly available SSH installations run their own forked version of OpenSSH? I don't see a way to chain AuthorizedKeysCommand and ForceCommand without maintaining (like an animal) files in a vanilla OpenSSH setup.

Thanks in advance for your help!

Answer 1

The AuthorizedKeysCommand description in the sshd_config

should produce on standard output zero or more lines of authorized_keys output

This means you can generate a command= option complete w/ command line arguments (or any other valid authorized_key option).

For example, the dynamically generated line could be something like:

no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="/path/to/program arg1 arg2 arg3'" ssh-rsa bigHugeLongLongKey alias

Thanks @kasperd for the direction!