1

As of OpenSSH 6.2, the option to use an external program for key pair based authentication is available with AuthorizedKeysCommand.

According to the sshd_config man page, this program should return zero or more lines of authorized_keys output.

Assuming the configured program returns multiple keys, is there a way (downstream in, say, the ForceCommand) to determine which of the returned keys was used to authenticate?

For example, this works great if you have a separate user for each key. However, if you're sharing a user (i.e. 'git') and you want to use a daemon wide ForceCommand (configured in the sshd_config), you lose the context of which externally identified user and which key was used to authenticate.

Gitlab (and Gitosis) does something similar where it shares a 'git' user but maintains the authorized_keys file to associate a key_id command line argument with their command= option that allows them to then externally determine permissions. This appears to be how they link the key authentication with the force command.

This solution works great on a smaller scale, but seems like a nightmare to scale to many millions of users that, say, Github has.

Do large scale, highly available SSH installations run their own forked version of OpenSSH? I don't see a way to chain AuthorizedKeysCommand and ForceCommand without maintaining (like an animal) files in a vanilla OpenSSH setup.

Thanks in advance for your help!

Improve this question
2
  • 1
    If you are generating a list of authorized keys dynamically, I don't see how it could be a problem to put the command on each line of the output along with an argument uniquely identifying the key on that line. Then you wouldn't even need to use ForceCommand.
    – kasperd
    Mar 24, 2015 at 16:54
  • @kasperd interesting. I hadn't even thought of generating the command. I imagine since the only requirement is it match the authorized_key format, that would work. I'll try it and let you know. Thanks for the suggestion!
    – chadmaughan
    Mar 24, 2015 at 17:07

1 Answer 1

Reset to default
0

The AuthorizedKeysCommand description in the sshd_config

should produce on standard output zero or more lines of authorized_keys output

This means you can generate a command= option complete w/ command line arguments (or any other valid authorized_key option).

For example, the dynamically generated line could be something like:

no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="/path/to/program arg1 arg2 arg3'" ssh-rsa bigHugeLongLongKey alias

Thanks @kasperd for the direction!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.