ssh how to allow a very limited user with no home to login with pubkey

Mojtaba Rezaeian

10/9/23, 10:34 AM

I have a very restricted user in my ssh server created with --no-create-home and --shell /bin/false. I know I can define authorized_keys file in sshd_configs for the user's public key. But how can I allow public key authentication for this user without requiring to access any files on OS?

3629

2 + 2

ssh

shell

public-key

ssh-keys

ciamej

10/9/23, 7:29 PM

I'm not sure what are you asking for exactly. Does diya's answer solve your problem? What exactly do you want your restricted user to do after logging in?

Mojtaba Rezaeian

10/10/23, 10:24 PM

@ciamej In my case this limited user is defined for tcp_forwarding (local ssh tunneling). I think diya's answer is useful for more complicated situations. I was thinking maybe a very simple command could be used or defined for a user to define known public keys, as simple as defining a password while creating a user.

Score:15

Server

Ángel

10/9/23, 8:53 PM

diya has already explained that you could change to AuthorizedKeysCommand for retrieving the public key of a user.

However, it's probably easier for you to place the authorized_keys file somewhere else. For example you could set AuthorizedKeysFile /etc/ssh/authorizedkeys/%u and place the file that would have been at ~username/.ssh/authorized_keys at /etc/ssh/authorizedkeys/username instead.

And, if you want to change it only for this user (so other users still have their authorized_keys at ~/.ssh/), you could use

Match User username
AuthorizedKeysFile /some/path/username_authorized_keys

+ 0

Score:11

Server

diya

10/9/23, 12:35 PM

The alternative to a file with public keys is the openssh server directive AuthorizedKeysCommand which allows you to configure your sshd daemon to run a specific helper program to retrieve the public keys that you would normally store and deploy in a users ˜/.ssh/authorized_keys file.

Using a LDAP directory is one common solution, querying an API or (MySQL) database are other examples.

See for example:

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: ssh how to allow a very limited user with no home to login with pubkey

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.