fatboyxpc/acces.sh

Maintain SSH authorized_keys with publicly accessible public keys

What is acces.sh?

This provides a very simple way to fetch public keys and generate an authorized_keys file. The motivation came from wanting to give my GitHub Team access to servers automatically by grabbing their public keys from their profiles.

Currently, we have support for GitHub teams, however, I would like to support other services (such as GitLab).

Dependencies

• jq

Usage

Generate a token and be sure to give it the permission read:org

Read org and team membership

./acces.sh --gh-token TOKEN --gh-org ORG --gh-team TEAM

By default, we write to /tmp/authorized_keys; however, you can override it with --keyfile /path/to/authorized_keys

Security Risks

Since we by default create a file at /tmp/authorized_keys, this poses a potential security threat on multi-user servers. See #2 for more information.

Alternatives

We found a few packages to solve this problem, but we were looking for something with simpler dependencies.

• https://github.com/stackbuilders/openssh-github-keys
• https://github.com/trevoro/sshauth
• https://github.com/spoqa/geofront

acces.sh's Issues

debug mode

Echo json if debug mode is truthy

Security Risk

This script works by creating a temporary file in /tmp rather than writing directly to the authorized_keys file (typically found in ~/.ssh/authorized_keys). The reason we chose to do this is so that we do not completely clobber the existing authorized_keys file in the event something goes wrong. Since all users have access to /tmp, that means /tmp/authorized_keys is able to be modified in any way between the time it gets created from this script and then moved to the appropriate place.

This is really only an issue when servers have multiple users with different permissions (such as a shared hosting server).