SSH Authentication
Last updated
Last updated
defguard allows you to configure SSH authentication on your servers to use public SSH keys stored in your instance's database. This is possible by using the AuthorizedKeysCommand option in OpenSSH daemon configuration file.
Each user can manage their public SSH (and GPG keys) in their user profile.
Also, when provisioning YubiKeys - those keys are also available in user profile (with info on which YK they are stored):
The specific API endpoint used for this is /api/v1/ssh_authorized_keys
. It returns a list of public keys, each in a new line. It allows you to filter you query by specifying a username, a group or a combination of both.
There's no specific configuration to be performed in defguard itself (aside from adding SSH keys for users of course), all the steps below are performed on the server you want to SSH into using defguard-supplied public keys:
Add a script which fetches SSH keys from your defguard instance
Make it executable, set correct ownership and permissions
Update OpenSSH daemon config (/etc/ssh/sshd_config
) to include following lines
Restart OpenSSH daemon
With this setup when a user someuser
tries to log in with SSH to your server the script will make a GET
request to your defguard instance and fetch a list of keys assigned to someuser
(if such a user exists). This list is then used to verify keys presented by the client.
Other script examples which can be useful in different server setups:
only allow users in the admin
group to log in with SSH
allow all users in admin
group to log in, but only to adminuser
account