#794568 OpenSSH server does not recognize principals option in authorized_keys file

Package:
openssh-server
Source:
openssh
Description:
secure shell (SSH) server, for secure access from remote machines
Submitter:
Gordon Grubert
Date:
2015-08-04 15:27:09 UTC
Severity:
normal
#794568#5
Date:
2015-08-04 14:10:42 UTC
From:
To:

Using the options

AuthorizedPrincipalsFile /etc/ssh/authorized_principals
TrustedUserCAKeys /etc/ssh/UGCA_ssh.pub

in /etc/ssh/sshd_config, a system-wide certificate based login with
certificates (signed by the given CA) matching given principals in
/etc/ssh/authorized_principals is possible.

Disabling these options and using an user-based configuration in
$HOME/.ssh/authorized_keys does not work. The authorized_keys file looks
like

cert-authority,principals=MYPRINCIPAL ssh-ed25519 AAAAC3NzaC1lZDI1NT.....

The ssh server says:

Bad options in /root/.ssh/authorized_keys file, line 1:
principals=MYPRINCIPAL ssh-ed25519 AAAAC3NzaC1lZDI1NT

The syntax of the file authorzied_keys seems to be invalid, but this
should be the syntax specified in man 8 sshd (section AUTHORIZED_KEYS
FILE FORMAT).

Best regards,
Gordon
#794568#10
Date:
2015-08-04 14:52:04 UTC
From:
To:
On 2015-08-04 15:10, Gordon Grubert wrote:
[...]

It's not - at least not precisely.

sshd(8) says that the option is

      principals="principals"

The quotes are part of the syntax. I can replicate the error you're
seeing by specifying principals=FOO, but principals="foo" parses fine.

Regards,

Adam
#794568#17
Date:
2015-08-04 15:16:04 UTC
From:
To:
You're right. Using quotes, everything is fine. IMHO, I had also tested
this scenario. Obviously, I did not. I'm not sure, that the line

    principals="principals"

in sshd(8) says, that you have to use quotes. sshd(8) also says for the
options:

    No spaces are permitted, except within double quotes.

This implies, to use quotes for spaces only.

Thx and best regards,
Gordon