Re: OpenSSH 6.2 AuthorizedKeysCommand

[Jason A. Donenfeld]

[1] http://www.openssh.com/txt/release-6.2

[Jason A. Donenfeld]

OpenSSH 6.2 now offers AuthorizedKeysCommand. From the changelog [1]:

* sshd(8): Added a sshd_config(5) option AuthorizedKeysCommand to
support fetching authorized_keys from a command in addition to (or
instead of) from the filesystem. The command is run under an account
specified by an AuthorizedKeysCommandUser sshd_config(5) option.

This might be a nice thing for gitolite to use, instead of what it
currently does with managing the flat text file.


Thoughts?

[Sitaram Chamarty]

Gitolite has a policy that -- once you have installed git and perl --
you don't need root for anything to do with gitolite. This would
require root.

People who want to use it can do so in several ways but what does it
*achieve*? How does it actually help?

It would have been nice if, instead of only the unix username (usually
"git") being passed to the program, they would also pass along the
fingerprint of the offered key. Now *that* would make the whole thing
suddenly *very* interesting, because you'd no longer be limited by
linear scan of the public keys in the authkeys file (or output of this
command). Your program would do a database lookup and return only the
one key that matches (or none if none matched).

When I first read about this features a few months ago, I sorta
assumed *this* is what they were doing and I was drooling. Until I
read the details.