Anyone got an idea how to do this:
- expose a user on a GNU/Linux system via ssh
- allow two keys access
- one is the “self” key, which should be allowed as-is
- the other is the “external” key, which triggers a password prompt
- otherwise, password login is not permitted
I know how to do most things of this, but not all at once (AuthenticationMethods is permitted in a Match block, but we cannot match on keys, we want access to the same user, and the “self” key can also be used (agent forwarding) from nōn-local addresses.
It seems like I’ll need a custom PAM module (arrrgh, I don’t want to write one of these) that asks for the password if key B is used (does SSH expose this to PAM?).
Anyone got a better idea?
#ssh #openssh #sshkeys #pam