klucznik

⚠️ Disclaimer: I use this program to learn Rust, Nix and to automate stuff for personal use.

Manage your ssh access keys automatically by for ex. synchronizing them from github.

Installation

$ cargo install --locked klucznik

Usage

⚠️ Using a program to get authorized keys or allow SSH access based on data got from a remote server could be risky and insecure. If someone has control over the server you get the data from, or control over the network you're on then the attacker could easily inject their own keys and get full access to your machines. TL;DR use common sense!

Install the binary (optional)

Install the binary to some globally accessible place:

$ sudo install --mode 755 --owner root --group root ~/.cargo/bin/klucznik /usr/local/bin/klucznik

As authorized_keys updater

⚠️ this will overwrite your authorized_keys file!

Set-up a cron job similar to this:

* 12 * * * /usr/local/bin/klucznik --sources https://github.com/<your username>.keys --destination /home/<user>/.ssh/authorized_keys

You can add more sources via more flags.

Alternatively, use ssh-key-dir to not overwrite your authorized_keys:

* 12 * * * /usr/local/bin/klucznik --sources https://github.com/<your username>.keys --destination /home/<user>/.ssh/authorized_keys.d/klucznik

Then configure your AuthorizedKeysCommand in sshd_config to use ssh-key-dir to that ssh reads your overlays from that folder.

As AuthorizedKeysCommand (experimental!)

Change the following settings in your sshd_config:

AuthorizedKeysCommand /usr/local/bin/klucznik --sources https://github.com/<username>.keys
AuthorizedKeysCommandUser root

AuthorizedKeysCommand is pretty picky about permissions, ownership etc. of that binary file. Make sure to read the proper man entry.

Roadmap

v0.1 'Not much more than overengineered curl replacement but works'

• configurable via command-line arguments/flags
• get authorized_keys from public URLs
• validate if in fact keys are returned (basic)
• save to file
• automated cargo release

v0.1.1

• fix writing multiple sources to one file
• if destination is provided, and file-contents are the same, don't overwrite
• if returned keys are empty, don't overwrite

v0.1.2

• fix created file permissions to 600

v0.2 'curl with centralized config'

• deduplicate keys
• config file support (remote + local)
• able to read/store host-specific configuration

v0.3

• add authenticated (private) URLs support

v1

• refine AuthorizedKeysCommand support (ability to use this instead of ssh-key-dir.
• ability to authorize directly from URLs (use AuthorizedKeysCommand and no authorized_keys
• make sure cache data properly so that it can still authenticate if Github/Gitlab is currently down.
• ability to chain commands in AuthorizedKeysCommand