Multiple ssh access types from a given user1/client to the same user2/server

Question

I want to access from one user/client combination (say, user1@cl) to a user/server combination (say, user2@srv) via ssh, with two different types of Access:

1. Access type #1 would be restricted to interactions with a bazaar repository. For this, I added a line (#1) in ~user2/.ssh/authorized_keys like
   

   command="bzr serve --inet --directory=/repodir --allow-writes",no-port-forwarding,no-X11-forwarding,no-agent-forwarding ssh-rsa ... user1@cl
   

2. Access type #2 would be a login shell. For this, I added a "usual" line (#2) in ~user2/.ssh/authorized_keys like
   

   ssh-rsa ... user1@cl
   

As I understand, and as I tested, both lines cannot be used simultaneously. I.e., if line #1 appears first in ~user2/.ssh/authorized_keys, then I would be able to interact with the bzr repo, but I will not be able to do

[user1@cl]$ ssh user2@srv

If line #2 appears first in ~user2/.ssh/authorized_keys, then I would be able to do ssh, but any bzr operation gives

bzr: ERROR: Not a branch ...

Is there any way to work this out?

I am using RHEL7, but I guess this is not important.

Related posts (but not addressing my case, as I understand):

https://stackoverflow.com/questions/2419566/best-way-to-use-multiple-ssh-private-keys-on-one-client

https://serverfault.com/questions/142997/what-options-can-be-put-into-a-ssh-authorized-keys-file

https://serverfault.com/questions/749474/ssh-authorized-keys-command-option-multiple-commands

https://askubuntu.com/questions/1962/how-can-multiple-private-keys-be-used-with-ssh

Answer 1

1. On your client machine generate two keys for user1, say /home/user1/key1 and /home/user1/key2. If you don't have particularly strong security concerns you might give an empty password to one of them, say to key1.

2. Copy both keys to the server with ssh-copy-id:

   ssh-copy-id -i ~/.ssh/key1 [email protected]
   ssh-copy-id -i ~/.ssh/key2 [email protected]
   

   Login with both of them, to make sure they work:

   ssh -i ~/.ssh/key1 [email protected]
   ssh -i ~/.ssh/key2 [email protected]
   

3. On the server edit your ~user2/.ssh/authorized_keys, and add command="bzr ..." to the first key.

4. Back on the client machine edit a file ~user1/.ssh/config, and add aliases for both keys. Something like this:

   Host alias1
       HostName        server.example.com
       User            user2
       IdentityFile    /home/user1/.ssh/key1
       ControlPath     ~/.ssh/ctl1-%u-%r-%h-%p
       ControlMaster   auto
       ControlPersist  5m
   
   Host alias2
       HostName        server.example.com
       User            user2
       IdentityFile    /home/user1/.ssh/key2
   

5. Now use bzr+ssh://alias1 for bazaar, and ssh alias2 for a login shell.

Further edit ~/.ssh/config to suit your needs, the syntax is the same as for /etc/ssh/ssh_config. That's about all.

Answer 2

I made it work, with two different key pairs (say, pair 1 for bzr and pair 2 for ssh login). I added the corresponding lines in ~user2/.ssh/authorized_keys. The private key 1 was stored in file id_rsa (which is read by default), and the private key 2 was stored in file id_rsa_ssh.

Then, bzr was working normally, and for logging in I use

[user1@cl]$ ssh -i id_rsa_ssh user2@srv

which indicates using an alternative identity.