cloudflare / cloudflare/cloudflared

🐛 Unix Usernames / SSO Identities Mismatch: `sshd_config` Configuration not Working

Open
#874 8 comments 0 reactions 0 assignees View on GitHub
Priority: Normal Type: Bug
Dominant language
Go
Stars
15.6k
Forks
1.4k
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

After following the setup instructions ["Advanced setup: Differing usernames"](https://developers.cloudflare.com/cloudflare-one/identity/users/short-lived-certificates/#2-ensure-unix-usernames-match-user-sso-identities), I can only log into my server as the user corresponding to the email address prefix used for authentication. (using `michael@mydomain.com` for authentication only allows me to log in as `michael@myserver`, not as e.g. `admin@myserver`).

**To Reproduce**

Steps to reproduce the behavior:
1. Follow the setup instructions ["Connect with SSH through Cloudflare Tunnel"](https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/use_cases/ssh/)
3. See error
4. Tunnel ID : `22706c82-38da-4845-a7d1-c0a1bb3bf18d`
5. cloudflared config: N/A (set up tunnel through dashboard, not manually on the server)

**Expected behavior**

After following the setup instructions ["Advanced setup: Differing usernames"](https://developers.cloudflare.com/cloudflare-one/identity/users/short-lived-certificates/#2-ensure-unix-usernames-match-user-sso-identities), I expect to be able to log into my server as an arbitrary user, irregardless of my email address prefix.

**Environment and versions**

- OS: Raspbian GNU/Linux 10 (buster)
- Architecture: armv7l (Cortex-A53)
- Version: 5.10.103-v7+

**Logs and errors**

[sshd_config.txt](https://github.com/cloudflare/cloudflared/files/10427884/sshd_config.txt)
[var_log_auth_log.log](https://github.com/cloudflare/cloudflared/files/10427902/var_log_auth_log.log)
[cloudflared_config_yaml.txt](https://github.com/cloudflare/cloudflared/files/10427921/cloudflared_config_yaml.txt)

**Additional context**

I am running a `cloudflared` tunnel on a Raspberry Pi. I have used an SSH application set up with a one-time-pin email access policy to access the terminal through my browser. I followed the instructions to use short-lived certificates for authentication. However, I am tring to log on as user `pi` when my authentication email is `michael@mydomain.com`. I followed the relevant setup instructions here: ["Advanced setup: Differing usernames"](https://developers.cloudflare.com/cloudflare-one/identity/users/short-lived-certificates/#2-ensure-unix-usernames-match-user-sso-identities) to edit my `sshd_config`, but this still only allows me to log on as user `michael` and not as user `pi`.

`sshd_config` (compare also attached file)

```
PubkeyAuthentication yes
TrustedUserCAKeys /etc/ssh/ca.pub

(...)

Match user pi
AuthorizedPrincipalsCommand echo 'john'
AuthorizedPrincipalsCommandUser nobody
```

`/var/log/auth.log` (compare also attached file):

```
Jan 15 08:55:10 MyRaspberryPi ssh [19217]: Accepted publickey for michaelfrom ::1 port 33284 ssh2: ECDSA-CERT SHA256: (...) ID (...) (serial (...)) CA ECDSA SHA256: (...)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.