openssh unix dev - Mar 2019 - Dynamically allow users with OpenSSH?

Hello, how can I dynamically allow or disallow users with OpenSSH? I
have some nodes that users can submit jobs to, and can optionally be
handed a session to the requested node. But I want to prevent them
from SSH-ing in to nodes unless they have a job running on that node.
My idea was to implement libssh's callback abilities and have a script
that checks the username against jobs running on the nodes to accept
or reject an incoming connection. However, after reading the manual, I
haven't found this capability. As I mentioned in this stack overflow
post
(https://stackoverflow.com/questions/55011729/how-to-dynamically-allow-users-in-openssh),
sshd_config:AllowUsers and sshd_config:AuthorizedKeysCommand are
insufficient to accomplish this.

Does OpenSSH have some sort of callback extensibility for dynamically
allowing or disallowing users based on an external script or file?
Thanks for your time.

why aren't the authorized keys/principals commands sufficient?

$ getent group maybe-allow-these-users
maybe-allow-these-users:x:111:user1,user2,user3,user4,user5...

Match Group maybe-allow-these-users
  AuthorizedPrincipalsCommand /etc/ssh/allow_if_running_job %u
  AuthorizedPincipalsCommandUser nobody

$ cat /etc/ssh/allow_if_running_job
#!/bin/sh
ps auxgw | grep $1 && echo $1

the AuthorizedKeysCommand could look like

$ cat /etc/ssh/allow_if_running_job
#!/bin/sh
ps auxgw | grep $1 && cat /home/$1/.ssh/authorized_keys

replace ps auxgw with whatever command you run to find out if the user
is running a job

On Wed, Mar 6, 2019 at 2:10 PM Isaiah Taylor <isaiah.p.taylor at
gmail.com> wrote:
>
> Hello, how can I dynamically allow or disallow users with OpenSSH? I
> have some nodes that users can submit jobs to, and can optionally be
> handed a session to the requested node. But I want to prevent them
> from SSH-ing in to nodes unless they have a job running on that node.
> My idea was to implement libssh's callback abilities and have a script
> that checks the username against jobs running on the nodes to accept
> or reject an incoming connection. However, after reading the manual, I
> haven't found this capability. As I mentioned in this stack overflow
> post
(https://stackoverflow.com/questions/55011729/how-to-dynamically-allow-users-in-openssh),
> sshd_config:AllowUsers and sshd_config:AuthorizedKeysCommand are
> insufficient to accomplish this.
>
> Does OpenSSH have some sort of callback extensibility for dynamically
> allowing or disallowing users based on an external script or file?
> Thanks for your time.
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev

>>>>> "IT" == Isaiah Taylor <isaiah.p.taylor at
gmail.com> writes:
IT> Does OpenSSH have some sort of callback extensibility for
IT> dynamically allowing or disallowing users based on an external
IT> script or file?

Seems more like the kind of thing you'd do through the PAM stack,
assuming your OS has that.  pam_script seems directly on point if you
want to make decisions based on arbitrary scripting.

Needless to say, PAM can be baroque and is part of the attack surface,
so significant care is warranted.

 - J<

Peter and Jason, thanks for your replies on this.

I was able to accomplish this with a combination of Peter's solution
and setting "AuthorizedKeysFile none" as suggested in the Stack
Overflow question.

On Wed, Mar 6, 2019 at 2:30 PM Peter Moody <mindrot at hda3.com>
wrote:
>
> why aren't the authorized keys/principals commands sufficient?
>
> $ getent group maybe-allow-these-users
> maybe-allow-these-users:x:111:user1,user2,user3,user4,user5...
>
> Match Group maybe-allow-these-users
>   AuthorizedPrincipalsCommand /etc/ssh/allow_if_running_job %u
>   AuthorizedPincipalsCommandUser nobody
>
> $ cat /etc/ssh/allow_if_running_job
> #!/bin/sh
> ps auxgw | grep $1 && echo $1
>
> the AuthorizedKeysCommand could look like
>
> $ cat /etc/ssh/allow_if_running_job
> #!/bin/sh
> ps auxgw | grep $1 && cat /home/$1/.ssh/authorized_keys
>
> replace ps auxgw with whatever command you run to find out if the user
> is running a job
>
> On Wed, Mar 6, 2019 at 2:10 PM Isaiah Taylor <isaiah.p.taylor at
gmail.com> wrote:
> >
> > Hello, how can I dynamically allow or disallow users with OpenSSH? I
> > have some nodes that users can submit jobs to, and can optionally be
> > handed a session to the requested node. But I want to prevent them
> > from SSH-ing in to nodes unless they have a job running on that node.
> > My idea was to implement libssh's callback abilities and have a
script
> > that checks the username against jobs running on the nodes to accept
> > or reject an incoming connection. However, after reading the manual, I
> > haven't found this capability. As I mentioned in this stack
overflow
> > post
(https://stackoverflow.com/questions/55011729/how-to-dynamically-allow-users-in-openssh),
> > sshd_config:AllowUsers and sshd_config:AuthorizedKeysCommand are
> > insufficient to accomplish this.
> >
> > Does OpenSSH have some sort of callback extensibility for dynamically
> > allowing or disallowing users based on an external script or file?
> > Thanks for your time.
> > _______________________________________________
> > openssh-unix-dev mailing list
> > openssh-unix-dev at mindrot.org
> > https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev