Debian Bug report logs - #560148
openssh-server - Please support multiple AuthorizedKeysFile

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Bastian Blank <waldi@debian.org>

To: submit@bugs.debian.org

Subject: openssh-server - Please support multiple AuthorizedKeysFile

Date: Wed, 9 Dec 2009 10:45:37 +0100

Package: openssh-server
Version: 1:5.1p1-8
Severity: wishlist

Please support multiple occurances of the AuthorizedKeysFile option,
like HostKey. I want to provision keys for admin users without writing
into /home. A similar setup is done with help of a workaround
(AuthorizedKeysFile2) on all debian.org machines.

Bastian

-- 
Captain's Log, star date 21:34.5...

Message #10 received at 560148@bugs.debian.org (full text, mbox, reply):

From: Bastian Blank <waldi@debian.org>

To: 560148@bugs.debian.org

Subject: patch

Date: Wed, 9 Dec 2009 12:51:34 +0100

[Message part 1 (text/plain, inline)]

tags 560148 patch
thanks

Please find the patch attached. It changes the behaviour to allow
multiple instances of the AuthorizedKeysFile option and should also
maintain the behaviour of the AuthorizedKeysFile2 option.

It is overly tested for the ssh2 part. But the ssh1 part only builds.

Bastian

-- 
Deflector shields just came on, Captain.

[diff (text/plain, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 560148@bugs.debian.org (full text, mbox, reply):

From: Colin Watson <cjwatson@debian.org>

To: Bastian Blank <waldi@debian.org>, 560148@bugs.debian.org

Subject: Re: Bug#560148: patch

Date: Wed, 9 Dec 2009 14:46:41 +0000

On Wed, Dec 09, 2009 at 12:51:34PM +0100, Bastian Blank wrote:
> Please find the patch attached. It changes the behaviour to allow
> multiple instances of the AuthorizedKeysFile option and should also
> maintain the behaviour of the AuthorizedKeysFile2 option.
> 
> It is overly tested for the ssh2 part. But the ssh1 part only builds.

Thanks for the patch. Could you please send this upstream, to
bugzilla.mindrot.org? It's usually best if patch submitters do this
directly. I have bad experiences with changing configuration file
semantics relative to openssh upstream, and try very hard to avoid doing
it.

Regards,

-- 
Colin Watson                                       [cjwatson@debian.org]

Message #22 received at 560148@bugs.debian.org (full text, mbox, reply):

From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

To: 560148@bugs.debian.org

Subject: multiple AuthorizedKeysFiles

Date: Wed, 09 Dec 2009 14:11:31 -0500

[Message part 1 (text/plain, inline)]

regarding the patch to support multiple authorizedkeysfile configuration
choices for sshd [0]:

AuthorizedKeysFile currently is not supported by the Match keyword.  If
this feature of multiple AuthorizedKeysFile entries was supported, it
would be ambiguous for use within a Match block (e.g. would a new
AuthorizedKeysFile within a Match be a replacement for the generic
AuthorizedKeysFile, or would it be in addition to?).

Martin Krafft's proposal for an authorized_keys directory [1] would
permit system configuration of the type Bastian is proposing through the
use of symlinks like this:

 mkdir /etc/ssh/authorized_keys/user17
 ln -s ~user17/.ssh/authorized_keys /etc/ssh/authorized_keys/user17/

and set:
   AuthorizedKeysFile /etc/ssh/authorized_keys/%u

This would allow future inclusion of AuthorizedKeysFile in a Match block
(as an unambiguous override of other settings).

	--dkg

[0] http://bugs.debian.org/560148
[1] http://bugs.debian.org/481251

[signature.asc (application/pgp-signature, attachment)]

Message #29 received at 560148@bugs.debian.org (full text, mbox, reply):

From: Bastian Blank <bastian@waldi.eu.org>

To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

Cc: 560148@bugs.debian.org

Subject: Re: multiple AuthorizedKeysFiles

Date: Thu, 10 Dec 2009 17:54:31 +0100

[ Please note that mails to $bug@bugs.debian.org are not sent to the
[ submitter, please also add $bug-submitter@bugs.debian.org to the
[ recipients.

On Wed, Dec 09, 2009 at 02:11:31PM -0500, Daniel Kahn Gillmor wrote:
> AuthorizedKeysFile currently is not supported by the Match keyword.  If
> this feature of multiple AuthorizedKeysFile entries was supported, it
> would be ambiguous for use within a Match block (e.g. would a new
> AuthorizedKeysFile within a Match be a replacement for the generic
> AuthorizedKeysFile, or would it be in addition to?).

This bug is actually written with my second variant in use. The first
one used a _list_ of entries in AuthorizedKeysFile to make that not
ambiguous. This however would need another metacharacter to split the
entries.

> Martin Krafft's proposal for an authorized_keys directory [1] would
> permit system configuration of the type Bastian is proposing through the
> use of symlinks like this:
>  mkdir /etc/ssh/authorized_keys/user17
>  ln -s ~user17/.ssh/authorized_keys /etc/ssh/authorized_keys/user17/

The core problem includes two such directories. One machine specific in
/etc/ssh and one network specific somewhere else with several hundred
users.

Bastian

-- 
Is truth not truth for all?
		-- Natira, "For the World is Hollow and I have Touched
		   the Sky", stardate 5476.4.

Send a report that this bug log contains spam.