I want to be able to block or allow users based on the result of an external script using OpenSSH. I see that libssh has support for callbacks, but after reading the OpenSSH man pages I cannot find anywhere that this functionality is handed to the user.
For example, I'd like to be able to maintain either a file or even an API that contains a username blacklist or whitelist, and have OpenSSH consult these lists during the authentication process.
Ideas I've had so far, and why they are insufficient:
Make use of
sshd_config:AllowUsers. This is a start, but since it does not read from a file, it is not dynamic. The configuration file would need to be changed every time and the service restarted. Additionally, modifying the config file from a script is dangerous and terrible.Make use of
sshd_config:AuthorizedKeysCommand. Unfortunately, while this does allow you to specify a script and grant access based on the result, it does not allow denial of access. If the script returns nothing,sshdcontinues to try other methods of authentication.Recompile OpenSSH with an addition that implements the
libsshcallbacks. I'd rather not do this for obvious reasons of maintainability.
Is there another method that I have missed while reading the documentation?