[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [rt.debian.org #7779] Semi-automated sync to vittoria -- SSH key management

On 19-05-29 05 h 13, Hector Oron via RT wrote:
> Sobre Dis 25 Mai 2019 15:07:52, pollo@debian.org ha escrit:
>> Hash: SHA512
>> Hi!
>> I'm following up on issue #13 in our ansible bug tracker [1] about
>> setting up a semi-automated sync to vittoria.
>> During confs and mini-confs, we need to be able to sync files from the
>> voctomix (live video mixer) machines in the rooms to Vittoria.
>> Currently, the way we do it is that a member of the videoteam group adds
>> temporary SSH keys to their Debian account for that machine.
>> What we would like to do is to be able to add restricted SSH keys,
>> allowed to access the sreview user, in the form of:
>> - ----------------------------------------------------------------------
>> command="/srv/sreview.debian.org/home/bin/rrsync -wo
>> /srv/sreview.debian.org/input",no-agent-forwarding,no-port-forwarding,no
>> - -pty,no-user-rc,no-X11-forwarding
>> ssh-rsa AAAAB[...]KYl videoteam@voctomixXY
>> - ----------------------------------------------------------------------
>> The actual sync is done via a CLI script (which is a basic rsync
>> wrapper) that can be found here [2]. The rrsync script is directly
>> gunzipped from rsync's documentation.
>> It seems that 1 year ago when Wouter approached DSA on IRC, you seemed
>> open to the ideas as long as the authorized keys changes were done
>> through a command line interface rather than through a webinterface.
>> Modifying the authorized_keys file would be done manually by a member of
>> the team at the beginning of each conference.
> What do you exactly need from DSA?

The current /etc/ssh/sshd_config file uses:

AuthorizedKeysFile /etc/ssh/userkeys/%u /var/lib/misc/userkeys/%u

This means /home/sreview/.ssh/authorized_keys isn't read by openssh-server.

If DSA agrees to what were proposing, this file would need to be read by
the openssh-server to let us sync files via rrsync.

  ⣾⠁⢠⠒⠀⣿⡁  Louis-Philippe Véronneau
  ⢿⡄⠘⠷⠚⠋   pollo@debian.org / veronneau.org

Attachment: signature.asc
Description: OpenPGP digital signature

Reply to: