authorized-exec/config.example.pl

# the patterns are read as regular expressions and anchored with ^ and $ by default
(
	'georg2:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFY7Pvf4Rzn7C8Ioi1ZvY/O7tJsMCv27URdQE5o1daDK' => [
		'echo hi',
		'true',
		'printf %s [a-z0-9 ]+',
	],
	'georg2' => [
		'echo bye',
	],
	'root' => [
		'ls -a /root',
	],
)
Anchoring For better security out of the box, always perform exact matching unless a more lenient pattern is explicitly provided by the administrator. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net> 2024-09-15 18:33:52 +02:00			`# the patterns are read as regular expressions and anchored with ^ and $ by default`
Example configuration Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net> 2024-09-11 20:35:20 +02:00			`(`
Support multiple keys per user In use cases where one user is supposed to be reachable with multiple public keys, but where each public key should only have access to a specific set of commands, the variable $SSH_USER_AUTH will be considered together with colon separated username->key pairs in the configuration to determine the set of commands to use. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net> 2024-09-15 19:23:03 +02:00			`'georg2:ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFY7Pvf4Rzn7C8Ioi1ZvY/O7tJsMCv27URdQE5o1daDK' => [`
Anchoring For better security out of the box, always perform exact matching unless a more lenient pattern is explicitly provided by the administrator. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net> 2024-09-15 18:33:52 +02:00			`'echo hi',`
			`'true',`
			`'printf %s [a-z0-9 ]+',`
Example configuration Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net> 2024-09-11 20:35:20 +02:00			`],`
Support multiple keys per user In use cases where one user is supposed to be reachable with multiple public keys, but where each public key should only have access to a specific set of commands, the variable $SSH_USER_AUTH will be considered together with colon separated username->key pairs in the configuration to determine the set of commands to use. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net> 2024-09-15 19:23:03 +02:00			`'georg2' => [`
			`'echo bye',`
			`],`
Example configuration Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net> 2024-09-11 20:35:20 +02:00			`'root' => [`
Anchoring For better security out of the box, always perform exact matching unless a more lenient pattern is explicitly provided by the administrator. Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net> 2024-09-15 18:33:52 +02:00			`'ls -a /root',`
Example configuration Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net> 2024-09-11 20:35:20 +02:00			`],`
			`)`