I have no idea why you're trying to do this, and it seems like a terrible idea.
That said, for some reason the question got me hooked and I needed to find an answer.
The short answer is that this can't readily be done by simply configuring the available packages in debian.
If you want to do this you have to write two modules: one for NSS and one for PAM.
For the NSS module you will need to provide at least
_getpwbynam_r. For the PAM module there's a lot more boilerplate.
This seems like a lot of work and not what you're looking for, but since you mention that you want to take care of authentication yourself, this is the way to do it.
A much simpler option (and probably a lot less secure) would be to use paramiko to setup a Python SSH server and customize/hook the authentication functions.
Fortunately, the guys at paramiko have already done most of the heavylifting in this demo server they have at their repo.
By replacing the
check_auth_publickey you can accept any user as valid. An example for password auth(*):
# pip install pam
MYUSER = 'testuser'
def check_auth_password(self, username, password):
if password and pam.authenticate(username=MYUSER, password=password):
Since this isn't StackOverflow I'm gonna stop there :)
This will create an ssh server that will ignore usernames for password authentication and will check the given password against
By default this server will prompt for a name and exit. You might want to replace that with a shell or your custom app.
I hardcoded the username, but you could just as easily get it from a config file or a database lookup or whatever.
You might also want to replace the
host_key variable and perhaps the port number.
There's so many ways to shoot yourself in the foot with this. You should be very very very careful. This code is not production ready, review the whole thing. If you don't find anything wrong in it you didn't do a good review ;-).
*: this is simply replacing a function in the
Server class in
demo_server.py and adding some stuff at the top