Providing configurations from client-side

[Wouterkoorn]

It would be really neat if it was possible to pass custom configuration from the client side (the ssh command) to the server side (auth/config server). For example allowing a user to specify which image to use on a per connection basis. Unfortunately the SSH protocol does not have anything built-in to allow this, so only it would have to be hacky...

I was first thinking about using "SendEnv" to send configuration options through environment variables, but the client sends this data only in the latest stage of the SSH protocol, which is too late to utilize in the auth/config server.

In our case because we are using the OAuth device flow authentication (0.5.0 alpha), we could actually utilize the username field to send custom data like the image name, as the oauth auth will provide us with the actual username. But this is of course not a pretty solution.

I was wondering if anyone else has thought about this, or actually implemented something similar?

[ghost]

Hi @Wouterkoorn, the only facility the SSH protocol has for this purpose would be keyboard-interactive. This protocol is used by the experimental OAuth / OIDC login, but it isn't even supported by all clients. Furthermore, some clients cut off the prompt text, or have other bugs.

The only reliable way to pass data to the server would be via the username itself, which seems to be fairly unrestricted. Early adopters of ContainerSSH have used this to "select" which environment they want to log in to. You could, for example, use the @ sign to separate the username from the additional attributes. The OpenSSH client supports this nicely too if I remember correctly:

ssh [email protected]@example.com

In this case [email protected] will be passed in the username, while example.com will be used for the SSH host to connect to.