Displaying 2 results from an estimated 2 matches for "authorizedprincipalfil".
Did you mean:
authorizedprincipalfile
2020 Jan 30
6
SSH certificates - restricting to host groups
On 30/01/2020 15:02, Christian, Mark wrote:
> On Thu, 2020-01-30 at 12:27 +0000, Brian Candler wrote:
>> As a concrete example: I want Alice to be able to login as "alice"
>> and
>> "www" to machines in group "webserver" (only). Also, I want Bob to
>> be
>> able to login as "bob" and "www" to machines in group
2020 Jan 31
2
SSH certificates - restricting to host groups
...>> carrying the authorization in the certs themselves - if that is in
>> the spirit of the SSH cert mechanism.
>
> Sign alice and bob's ssh cert with principal's alice,www and bob,www
> respectively. Configure sshd_config so that individuals don't require
> an authorizedprincipalfile, and use Match within sshd_config for any
> "service/faceless" account like www, to force use of an
> authorizedprincipalfile. The contents of www's authorizedprincipal
> file will simply contain the principal "www" or whatever you
> choose. This should limit...