Comment by egberts1

3 months ago

Purpose of first-define is the rule: In placing configuration files higher than user-defined configuration but Only with SSH client, can want user to have control from their config files: Remove from config files Place a couple under Match/MatchGroup using deny/accept.

SSHD (server/non-client) still support admin-defined by having system-wide settings done firstly. For those who have multi-file SSHD configurations, breakdown of the many config file locations and scopes here as it covers default user, system-wide, specific user:

https://egbert.net/blog/articles/ssh-openssh-options-ways.ht...

Also I broken out each and every SSHD and SSH options along with their ordering by execution by using file name and numbering as well as its various state machine, dispatch, CLI equivalence, network context, and function nesting, all in:

https://github.com/egberts/easy-admin/tree/main/490-net-ssh

https://github.com/egberts/easy-admin/blob/main/490-net-ssh/...

Disclaimer: I do regular code reviews of OpenSSH and my employer authorizes me to release them (per se contract and NDA)

Also this showed how to properly mix and match authentication types using OR and AND logic(s) in

https://serverfault.com/a/996992

It is my dump mess so wade 'em and enjoy.

15 comments

egberts1

Reply
egberts1  3 months ago

For those that are exploring software-based public certificate and OpenSSH, Ive broken down the settings for most PKI handlers.

https://egbert.net/blog/articles/openssh-file-authorized_key...

  • memco  3 months ago

    Thanks for sharing this! I think I may now have what I need to set up a system with multi-user shared keys that only work for a given set of users.

    • egberts  3 months ago

      I do enjoy dual-PK-certificate authentication in my homelab: one by equipment, and one by user/group.

      Only misgiving is that the key management issues have worsen only for the key administrator(s). But it is a viable and sustainable AA model because there is the most important security component: instant denial of a user and/or a equupment.

  • gosub100  3 months ago

    We must have knocked your site offline

    • egberts1  3 months ago

      Uptime remains uninterrupted.

      Are you using the verboten Chrome and its inability to negotiate and defer to server absolut side of ChaCha20-Poly1305 with sha512? It refuses client-demanded Chrome-forced ChaCha/sha256, AES and then RSA.