1

I'd like to modify sshd_config file to run one script if user ssh in with password and another script if user ssh into server using SSH Signed certificate. I see, This might be possible with the combination of Match and ForceCommand but I'm having hard time to understand how to identify if user used PasswordAuthentication to get in or SSH Cert to get into the server.

For ex something like below:

Match (If User used password) ForceCommand /usr/sbin/passwordscript

Match (If User used pubkey) ForceCommand /usr/sbin/pubkeyscript

Match (If User used TrustedUserCAKeys(?)) ForceCommand /usr/sbin/sshcertdscript

Is there any way I can find how user is trying do ssh into server whether its a password, public key or TrustedUserCAKeys(SSH Cert)?

Thanks in Advance..

Improve this question
1

In authorized_keys file, you can specify a command to be used, when authenticating with a particular key pair. You can also set an environment variable using environment option:

command="/path/script",command="KEY_WAS_USED=yes" ssh-rsa ...

And then you can check an existence of the variable in some startup script to execute your "non-key" (password) script.

Improve this answer
  • Thanks Martin.. There might be a chance if user is setting up the environment variable to avoid executing particular script. For ex: if I want to have MFA in password use case and but not in keys use case then user "might" set that environment variable that KEY_WAS_USED=yes and we might see this value for password use case too. This might be possible. Am I correct? Just to be curios, there is no way we can know that in sshd_config file at run time? – Quick Learner May 11 '18 at 18:52
  • I'm aware that this is not a perfect solution, but I do not know any better. – Martin Prikryl May 12 '18 at 5:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.