fernandomiguel/sshremotekeys

Managing SSH keys remotely to control access to hosts

sshremotekeys's Issues

Cache for rate limits

I'm not aware of average key rotation time of the user this package is written for, but I would consider acceptable to cache my keys for, let's say, 5 minutes, without compromizing security in case of key revocation.

Back from easter vacation I can PR a change, if you haven't written something yet.

nobody has no $home

since AuthorizedKeysCommand runs as nobody, the key cache dir can't be $home.

sudo -Hu nobody /usr/local/bin/userkeys.sh
/nonexistent/.ssh/authorized_keys_cache
/usr/local/bin/userkeys.sh: 20: /usr/local/bin/userkeys.sh: cannot create /nonexistent/.ssh/authorized_keys_cache: Directory nonexistent

the script needs to be customized to replace "USER" with your own username?

It seems your script hardcode the username USER, and that seems quite dangerous given you don't really state it in the docs that you should absolutely customize it.

I guess there is a better solution, which is to use the first argument passed to the script when sshd invokes the command:

     AuthorizedKeysCommand
             Specifies a program to be used to look up the user's public keys.  The program must be
             owned by root, not writable by group or others and specified by an absolute path.  Argu‐
             ments to AuthorizedKeysCommand accept the tokens described in the TOKENS section.  If no
             arguments are specified then the username of the target user is used.