-
Notifications
You must be signed in to change notification settings - Fork 8.1k
Description
request: don't override User directive in ssh_config
I pre-generate ssh host keys which I deploy to cloud instances using cloud-init for use by their ssh daemons. This allows me to generate local ssh client configuration files:
- a
known_hostsfile containing, for each instance, the instance's public key; and - an
ssh_configfile containing, for each instance, aUserKnownHostsFiledirective pointing to theknown_hostsfile, aUserdirective providing the instance's system administrator username (e.g.: "ec2-user" for AWS RedHat instances, "sysadmin" for AWS Debian instances, "Administrator" for Windows Server instances, etc.), and aProxyJumpdirective so that connections to the instances are routed through a bastion host.
This allows me to avoid security warnings regarding unknown host keys, etc. and to use ansible without compromising the ssh security model.
PowerShell Core Remoting over SSH uses the underlying operating system's ssh client. In the case of OpenSSH on Linux or macOS, this means that the ssh_config and known_hosts files that I generated provide the directives necessary for a secure connection as described above.
This works perfectly except that StartSSHProcess always passes a User command line parameter to the ssh client, overriding the User directive in ssh_config.
As a system administrator, I want to generate ssh configuration files containing directives that aren't overriden by PowerShell's invocation of ssh.
proposal: do not pass -l <username> to ssh client unless -UserName <username> is passed to cmdlets
When invoking *PSSession cmdlets, if -UserName <username> isn't used , then don't pass -l <username> as a command line argument to the ssh client.