1

As of OpenSSH 6.2, the option to use an external program for key pair based authentication is available with AuthorizedKeysCommand.

According to the sshd_config man page, this program should return zero or more lines of authorized_keys output.

Assuming the configured program returns multiple keys, is there a way (downstream in, say, the ForceCommand) to determine which of the returned keys was used to authenticate?

For example, this works great if you have a separate user for each key. However, if you're sharing a user (i.e. 'git') and you want to use a daemon wide ForceCommand (configured in the sshd_config), you lose the context of which externally identified user and which key was used to authenticate.

Gitlab (and Gitosis) does something similar where it shares a 'git' user but maintains the authorized_keys file to associate a key_id command line argument with their command= option that allows them to then externally determine permissions. This appears to be how they link the key authentication with the force command.

This solution works great on a smaller scale, but seems like a nightmare to scale to many millions of users that, say, Github has.

Do large scale, highly available SSH installations run their own forked version of OpenSSH? I don't see a way to chain AuthorizedKeysCommand and ForceCommand without maintaining (like an animal) files in a vanilla OpenSSH setup.

Thanks in advance for your help!

Improve this question
2
  • 1
    If you are generating a list of authorized keys dynamically, I don't see how it could be a problem to put the command on each line of the output along with an argument uniquely identifying the key on that line. Then you wouldn't even need to use ForceCommand.
    – kasperd
    Commented Mar 24, 2015 at 16:54
  • @kasperd interesting. I hadn't even thought of generating the command. I imagine since the only requirement is it match the authorized_key format, that would work. I'll try it and let you know. Thanks for the suggestion!
    – chadmaughan
    Commented Mar 24, 2015 at 17:07

1 Answer 1

Reset to default
0

The AuthorizedKeysCommand description in the sshd_config

should produce on standard output zero or more lines of authorized_keys output

This means you can generate a command= option complete w/ command line arguments (or any other valid authorized_key option).

For example, the dynamically generated line could be something like:

no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="/path/to/program arg1 arg2 arg3'" ssh-rsa bigHugeLongLongKey alias

Thanks @kasperd for the direction!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .