3 ms·

I don't think you can use PAM for authentication if you want to use public key authentication (see auth2-pubkey.c in Portable OpenSSH).

• timf 17y ago
  Thanks, sorry for the confusion. So what they needed but did not have is an authorization (not authentication) callout after the daemon has verified the remote user's identity (vs. the built in 'callout' of looking at a user's authorized_keys file).
  • noste 17y ago
    Hmm, I think this part is still about authentication as sshd cannot authenticate the user without the keys. According to the article, GitHub does the authorization in their Gerve script.
    • timf 17y ago
      This is all sort of pedantic but the way I read the situation is that the only authentication is proving that the entity on the other end possesses the private key associated with a certain public key. The authorization part is two fold: is key X authorized to access account Y. And then it's passed on to Gerve for more specific authorization checks. Having implemented such things, I am probably thinking more about the internal situation, sorry..