Re: Read host keys from environment variables
Brian Candler <[email protected]>
| Newsgroups | gmane.network.openssh.devel |
|---|---|
| Message-ID | <[email protected]> |
On 11/08/2026 13:22, Philipp Marek wrote: > Yeah, but that doesn't work in plain containers > (without user namespaces to separate multiple unix users) -- > everything in them runs as the same unix user. > Something like podman perhaps? It might be worth describing your use case in more detail. If you're running sshd and the spawned sftp sessions as the same unix user, then I'd expect anyone who breaks out of an sftp session would be able to access anything that sshd can, including its host key (and its environment for that matter). > And having user namespaces means higher-privileged containers, > which is another can of worms. The container environments I use (primarily incus these days) use /etc/subuid and /etc/subgid to map containers to uids 1000000+U where U is the uid in the container. Generally these are lower privileged containers. _______________________________________________ openssh-unix-dev mailing list [email protected] https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev