Using certificates for SSH authentication [LWN.net]

Using certificates for SSH authentication

Posted Nov 9, 2022 21:49 UTC (Wed) by mjg59 (subscriber, #23239)
In reply to: Using certificates for SSH authentication by amarao
Parent article: Using certificates for SSH authentication

You can use AuthorizedPrincipalsCommand for this, with a bootstrap user - when a user tries to log in as the bootstrap user, extract the user principal from the certificate, create the user, and then exit. The user can now log in. It's a little cumbersome, but it works.

to post comments

Using certificates for SSH authentication

Posted Nov 9, 2022 21:58 UTC (Wed) by amarao (guest, #87073) [Link] (1 responses)

We've tried. It doesn't work. Ssh consults pam for user existence at key validation time. No user, no auth.

Using certificates for SSH authentication

Posted Nov 9, 2022 22:33 UTC (Wed) by mjg59 (subscriber, #23239) [Link]

Right. You need a separate bootstrap user (which actually exists) to trigger user creation. It's a somewhat clumsy solution, but it avoids needing to pre-create every user everywhere.