Provide an updated OpenSSH for CentOS 6 users
Geo requires at least OpenSSH v6.9 for database lookups of SSH keys. In particular, it requires the %k
argument to AuthorizedKeysCommand
.
This requirement is met by every platform we support except CentOS 6 (CentOS 7 just got OpenSSH 7.4 via the CentOS 7.4 release).
To ease Geo adoption among CentOS users, we should provide curated OpenSSH packages that replace the system sshd with one that supports the Geo use case.
Original description:
Using the system's sshd can be tricky because you need to configure it for a high volume of sessions, just to allow
git > clone
over SSH. Also it makes it hard to ship our AuthorizedKeysCommand feature (automaticlaly editing sshd_config is no > fun, AuthorizedKeysCommand is only included in recent OpenSSH versions).How about these two features:
- Bundle sshd in omnibus-gitlab. Off by default, port 2222, run as 'git', hard-coded to execute gitlab-shell after authentication
- In the upcoming bundled HAproxy, allow balancing user-facing port 22 over backend port 2222 instances
cc @marin @pcarranza