{"action":"created","issue":{"url":"https://api.github.com/repos/widdix/aws-ec2-ssh/issues/2","repository_url":"https://api.github.com/repos/widdix/aws-ec2-ssh","labels_url":"https://api.github.com/repos/widdix/aws-ec2-ssh/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/widdix/aws-ec2-ssh/issues/2/comments","events_url":"https://api.github.com/repos/widdix/aws-ec2-ssh/issues/2/events","html_url":"https://github.com/widdix/aws-ec2-ssh/issues/2","id":164130957,"number":2,"title":"Create user on the fly?","user":{"login":"fbrnc","id":468820,"avatar_url":"https://avatars.githubusercontent.com/u/468820?v=3","gravatar_id":"","url":"https://api.github.com/users/fbrnc","html_url":"https://github.com/fbrnc","followers_url":"https://api.github.com/users/fbrnc/followers","following_url":"https://api.github.com/users/fbrnc/following{/other_user}","gists_url":"https://api.github.com/users/fbrnc/gists{/gist_id}","starred_url":"https://api.github.com/users/fbrnc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fbrnc/subscriptions","organizations_url":"https://api.github.com/users/fbrnc/orgs","repos_url":"https://api.github.com/users/fbrnc/repos","events_url":"https://api.github.com/users/fbrnc/events{/privacy}","received_events_url":"https://api.github.com/users/fbrnc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-07-06T17:30:22Z","updated_at":"2016-09-17T11:26:35Z","closed_at":null,"body":"Hi Michael,\r\n\r\nexcellent [blog post](https://cloudonaut.io/manage-aws-ec2-ssh-access-with-iam/) and thanks for sharing this idea including the code!\r\n\r\nI was wondering why you're importing all users (and updating them every 10min). Since you're already running a custom script with `AuthorizedKeysCommand` couldn't you at that point look up if that user exists in IAM and has a public key and only then create it on the fly? (Or will this command fail before ssh even gets to execture this script because the user isn't already there?)\r\nThere could be a simple caching mechanism to avoid doing that for every single SSH connection or once the user is created it will not reevaluate the key (and then there could be a cron deleting those keys/user every hour or so forcing the next login after that to reevaluate).\r\n\r\nI'm thinking about adopting this idea, but in our use case we have different teams that need access to different sets of servers (with some overlap). I'm thinking of checking the user's groups (with `aws iam list-groups-for-user --user-name ...`) and only allow access if the current server \"type\" (just a key that we made up) matches one of the user's groups.\r\n\r\nLastly one more thought: Our AWS accounts use email addresses as usernames, but those will be rejected by the `adduser` command. So there probably should be some sanitation before creating the user."},"comment":{"url":"https://api.github.com/repos/widdix/aws-ec2-ssh/issues/comments/247764200","html_url":"https://github.com/widdix/aws-ec2-ssh/issues/2#issuecomment-247764200","issue_url":"https://api.github.com/repos/widdix/aws-ec2-ssh/issues/2","id":247764200,"user":{"login":"jonleighton","id":1979,"avatar_url":"https://avatars.githubusercontent.com/u/1979?v=3","gravatar_id":"","url":"https://api.github.com/users/jonleighton","html_url":"https://github.com/jonleighton","followers_url":"https://api.github.com/users/jonleighton/followers","following_url":"https://api.github.com/users/jonleighton/following{/other_user}","gists_url":"https://api.github.com/users/jonleighton/gists{/gist_id}","starred_url":"https://api.github.com/users/jonleighton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jonleighton/subscriptions","organizations_url":"https://api.github.com/users/jonleighton/orgs","repos_url":"https://api.github.com/users/jonleighton/repos","events_url":"https://api.github.com/users/jonleighton/events{/privacy}","received_events_url":"https://api.github.com/users/jonleighton/received_events","type":"User","site_admin":false},"created_at":"2016-09-17T11:26:35Z","updated_at":"2016-09-17T11:26:35Z","body":"FWIW, I ended up not using keymaker in the end as various things didn't work in my situation, and it was hard to customise. I went with an approach inspired by this project, which meant that it was a lot easier to tailor the solution to my needs. I didn't do the PAM hook at all - in reality we add new users very rarely, so having a wait a minute for the addition to take effect is not a big deal."}}
{"actor":{"display_login":"jonleighton"}}