0

My requirement is simple. I have generated a SSH key-pair (Public and Private) on a server say "A". Now I have uploaded my Public SSH key in AWS IAM and have generated a SSH key ID to connect to a CodeCommit Repository via SSH. In server "A" after updating the ".ssh/config" with the values of SSH-Key ID and path to the private key file I should be able to connect to the repository successfully and I was also able to do this. Now my requirement is when I try to connect to repository from another server say "B" (Private key has been trasnfered to the server and the .ssh/config file also update as same as in server "A") I should not be able to connnect i.e, the key pair should work only in the server it is generated and not allow connection from any other server. Is this possible? I was not able to find anything solid after googling.

1
  • @drewbenn Just a security measure. Even if one of my developers with access to the repository makes his key public, no one else should be able to access the repo
    – vishal
    Jul 19 '19 at 10:11
2

You can, if the remote uses the usual authorized_keys files.

The sshd(8) man page describes the authorized_keys file format. There are a number of options that can be used in the file, one of them is this:

from="pattern-list"

Specifies that in addition to public key authentication, either the canonical name of the remote host or its IP address must be present in the comma-separated list of patterns. See PATTERNS in ssh_config(5) for more information on patterns.

So, a line like this would only allow access from hosta.example.org:

from="hosta.example.org" ssh-rsa AAAA...== user@example.org

Though I'm not sure why you wouldn't just create distinct keys for the two client hosts A and B. That would make it very easy to control which host has access where — the keys would be tied to the hosts.

3
  • 1
    Correct me If I'm wrong. From my understanding I have to add this "from=....." in front of the private key's content present in ".ssh/authorized_keys"
    – vishal
    Jul 18 '19 at 10:58
  • @vishal.k, yes, at the start of the line, before the type (ssh-rsa, ssh-ed25519, ecdsa-sha2-nistp256 or what have you).
    – ilkkachu
    Jul 18 '19 at 16:38
  • 1
    @vishal.k Just a small correction: authorized_keys contains the public keys, not the private keys.
    – Panki
    Jul 19 '19 at 8:44
1

This is not possible as you added the private key to server's B ssh config. However, you can restrict access to the A server by other means, e.g. firewall rule allowing ssh connection only from one IP.

3
  • Note that there is no need to add the file to the config if it is placed in the correct directory (~/.ssh)
    – Panki
    Jul 18 '19 at 10:08
  • By config I meant proper directory.
    – flanker12X
    Jul 18 '19 at 10:29
  • Guess you guys should check out the below answer from ilkkachu
    – vishal
    Jul 18 '19 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.