Bug#983464: openssh-server: Forced command affects all keys

Timo Weingärtner <[email protected]> Wed, 24 Feb 2021 18:33:36 +0100

Newsgroups	gmane.linux.debian.devel.ssh
Message-ID	<4789668.DiWh60cFF9__4660.79358463816$1614189988$gmane$org@timo01.tiwe.de>

Hallo Henrik Christian Grove,

24.02.21 17:36 Henrik Christian Grove:
> Package: openssh-server
> Version: 1:8.4p1-4
> Severity: normal
> X-Debbugs-Cc: [email protected]
> 
> (I guess - but haven't checked in any way - that this also affects
> upstream)
> 
> (There are many open bugs against this package, so I didn't carefully
> read the list, but did search it - without finding this issue)
> 
> The sshd manpage says:
>      command="command"
>              Specifies that the command is executed whenever this key is
> used for authentication.
> 
> but when I add such an option on one key in my authorized_keys file, so
> it looks like:
> ssh-rsa AAAAB3... [email protected]
> command="/bin/hostname" ssh-rsa AAAAB3N... [email protected]
> (I've shortened my public keys, as they are completely irrelevant, if
> you want to give me access to some machine, ask me for the complete key)
> 
> I get the output of /bin/hostname no matter which key I use:
> grove@stacey> ssh -i .ssh/privat_rsa 10.0.3.106 date
> sid
> grove@stacey> ssh -i .ssh/id_rsa 10.0.3.106 date
> sid

Which key is accepted by the server? You can see that in either of:
* ssh -v, search for "Server accepts key"
* sshd log, search for "Accepted publickey for"

You may have the "wrong" key in your ssh-agent and you're not using 
"IdentitiesOnly=yes".


Grüße
Timo

signature.asc (application/pgp-signature, 833 B)