1

I want to be able to block or allow users based on the result of an external script using OpenSSH. I see that libssh has support for callbacks, but after reading the OpenSSH man pages I cannot find anywhere that this functionality is handed to the user.

For example, I'd like to be able to maintain either a file or even an API that contains a username blacklist or whitelist, and have OpenSSH consult these lists during the authentication process.

Ideas I've had so far, and why they are insufficient:

  1. Make use of sshd_config: AllowUsers. This is a start, but since it does not read from a file, it is not dynamic. The configuration file would need to be changed every time and the service restarted. Additionally, modifying the config file from a script is dangerous and terrible.

  2. Make use of sshd_config: AuthorizedKeysCommand. Unfortunately, while this does allow you to specify a script and grant access based on the result, it does not allow denial of access. If the script returns nothing, sshd continues to try other methods of authentication.

  3. Recompile OpenSSH with an addition that implements the libssh callbacks. I'd rather not do this for obvious reasons of maintainability.

Is there another method that I have missed while reading the documentation?

2 Answers 2

1

For 2. you could limit authentication to publickey with AuthenticationMethods.

Another option is to use PAM and implement your own PAM authz module.

1
  • Thanks, limiting to publickey auth did not block it because it would still check authorized_keys. I ended up disabling that. PAM would also be a valid way to implement this. Mar 7, 2019 at 18:23
0

Option 2 is sufficient if you disable checking authorized_keys:

sshd_config:

AuthorizedKeysCommand /etc/ssh/my-custom-command
AuthorizedKeysUser nobody
AuthorizedKeysFile none

my-custom-command:

# $1 is user, as passed from sshd

#psuedo code:
if $1 is in whitelist:
cat /home/$1/.ssh/authorized_keys
exit 0
else
exit 1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.