Match Principal enhancement

Bret Giddings bretgiddings at
Mon Nov 13 00:09:18 AEDT 2023

Hi OpenSSH devs,

I’m wondering if the following has any merit and can be done securely ...

If you could match on principals in the sshd_config, then (for example) on a gateway machine, you could have something like


cert-authority,principals=“batcha-fwd,batchb-fwd” ...

/etc/ssh/sshd_config containing:

Match User sshfwd
    PubkeyAuthentication            yes
    PasswordAuthentication          no
    GatewayPorts                    no
    AllowTcpForwarding              yes
    HostbasedAuthentication         no
    AllowAgentForwarding            no
    X11Forwarding                   no
    Banner                          none
    ForceCommand                    /bin/false
    AuthorizedKeysFile              /etc/ssh/authorized_keys/%u

Match Principal batcha-fwd

Match Principal batcha-fwd

This would mean that on the ssh gateway machine, you don’t need an account for every remote batch account that needs to connect, assuming that a signed key has previously been provided with appropriate principals (and maybe source-addresses etc). They would be configured to use something like the following in their ssh config file

Host <>
    User sshfwd
    ProxyJump none

Host *
    IdentitiesOnly yes
    IdentityFile batcha
    User batcha
    ProxyJump batcha

I can also see other potential uses for it on target computers where I only allow connections using keys signed by a trusted CA.



More information about the openssh-unix-dev mailing list