As of OpenSSH 6.2, the option to use an external program for key pair based authentication is available with
According to the
sshd_config man page, this program should return zero or more lines of
Assuming the configured program returns multiple keys, is there a way (downstream in, say, the
ForceCommand) to determine which of the returned keys was used to authenticate?
For example, this works great if you have a separate user for each key. However, if you're sharing a user (i.e. 'git') and you want to use a daemon wide
ForceCommand (configured in the sshd_config), you lose the context of which externally identified user and which key was used to authenticate.
Gitlab (and Gitosis) does something similar where it shares a 'git' user but maintains the
authorized_keys file to associate a
key_id command line argument with their
command= option that allows them to then externally determine permissions. This appears to be how they link the key authentication with the force command.
This solution works great on a smaller scale, but seems like a nightmare to scale to many millions of users that, say, Github has.
Do large scale, highly available SSH installations run their own forked version of OpenSSH? I don't see a way to chain
ForceCommand without maintaining (like an animal) files in a vanilla OpenSSH setup.
Thanks in advance for your help!