[HN Gopher] Using -/.ssh/authorized keys to decide what the inco...
       ___________________________________________________________________
        
       Using -/.ssh/authorized keys to decide what the incoming connection
       can do
        
       Author : jandeboevrie
       Score  : 44 points
       Date   : 2025-04-18 04:17 UTC (18 hours ago)
        
 (HTM) web link (dan.langille.org)
 (TXT) w3m dump (dan.langille.org)
        
       | pickle-wizard wrote:
       | Handy stuff. This would be good for restricting service accounts.
       | 
       | There is a whole lot that SSH can do that most people don't know
       | about.
        
         | m463 wrote:
         | > There is a whole lot that SSH can do that most people don't
         | know about.
         | 
         | I had to port ssh to embedded hardware decades ago, and pulling
         | back the curtains I came to the opinion that everything was a
         | mess.
         | 
         | for example, I needed to be able to upload/download firmware,
         | and was surprised to find that scp wasn't a pure file transfer
         | protocol. It is more like "log into the remote system via shell
         | and run a file transfer program"
         | 
         | There are lots of other things I didn't like, like wholesale
         | transferring environment variables back and forth, weird shell
         | interactions and more.
         | 
         | It is very useful, but it is an organically grown program, not
         | a designed protocol.
        
       | nneonneo wrote:
       | In my setup, I have one host that can take multiple actions on a
       | second host, with a restricted set of file paths.
       | 
       | I created a shell script on the second host called "from_host_1"
       | which implements the logic to parse the first host's request and
       | any file paths it supplies, validates them, translates the paths
       | as needed, and then executes the corresponding program.
       | 
       | This way, I can just use a single SSH key which can perform
       | multiple functions. On the first host, I have a bunch of tiny
       | scripts like `~/bin/func` which basically performs `ssh
       | secondhost func "$@"`.
       | 
       | In the OPs case, they seem to have two different hosts which can
       | run two different commands. Two separate SSH keys seems like a
       | reasonable thing to do, because sharing the same key across two
       | systems increases your risk if one machine is compromised.
        
       ___________________________________________________________________
       (page generated 2025-04-18 23:02 UTC)