95eee5369d
- Briefly cover sshcommand internals - Show several examples for using sshcommand - Split out docs onto a new page and relink to it where necessary - Refer to user-auth plugin trigger for scoping commands to specific users. [ci skip]
49 lines
2.4 KiB
Markdown
49 lines
2.4 KiB
Markdown
# User Management
|
|
|
|
While it is possible to use password-based authorization to push to Dokku, it is preferable to use key-based authentication for security.
|
|
|
|
Users in dokku are managed via the `~/dokku/.ssh/authorized_keys` file. While you *can* manually edit this file, it is **highly** recommended that you follow the below steps to manage users on a dokku server.
|
|
|
|
## SSHCommand
|
|
|
|
Dokku uses the [`sshcommand`](https://github.com/dokku/sshcommand) utility to manage ssh keys for the dokku user. The following is the usage output for sshcommand.
|
|
|
|
```
|
|
sshcommand create <user> <command> # creates a user forced to run command when SSH connects
|
|
sshcommand acl-add <user> <ssh-key-name> # adds named SSH key to user from STDIN
|
|
sshcommand acl-remove <user> <ssh-key-name> # removes SSH key by name
|
|
sshcommand help # displays the usage help message
|
|
```
|
|
|
|
In dokku's case, the `<user>` section is *always* `dokku`, as this is the system user that the dokku binary performs all it's actions. Keys are given unique names, which can be used in conjunction with the [user-auth](/dokku/development/plugin-triggers/#user-auth) plugin trigger to handle command authorization.
|
|
|
|
## Adding deploy users
|
|
|
|
You can add your public key to the dokku user's `~/dokku/.ssh/authorized_keys` file with the following command:
|
|
|
|
```shell
|
|
# from your local machine
|
|
# replace dokku.me with your domain name or the host's IP
|
|
# replace root with your server's root user
|
|
# USER is the username you use to refer to this particular key
|
|
cat ~/.ssh/id_rsa.pub | ssh root@dokku.me "sudo sshcommand acl-add dokku USER"
|
|
```
|
|
|
|
At it's base, the `sshcommand` *must* be run under a user with sudo access, as it sets keys for the dokku user.
|
|
|
|
For instance, if you stored your public key at `~/.ssh/id_rsa.pub-open` and are deploying to EC2 where the default root-enabled user is `ubuntu`, you can run the following command to add your key under the `superuser` username:
|
|
|
|
```
|
|
cat ~/.ssh/id_rsa.pub-open | ssh ubuntu@dokku.me "sudo sshcommand acl-add dokku superuser"
|
|
```
|
|
|
|
If you are using the vagrant installation, you can also use the `make vagrant-acl-add` target to add your public key to dokku (it will use your host username as the `USER`):
|
|
|
|
```
|
|
cat ~/.ssh/id_rsa.pub | make vagrant-acl-add
|
|
```
|
|
|
|
## Scoping commands to specific users
|
|
|
|
See the [user auth plugin trigger documentation](/dokku/development/plugin-triggers/#user-auth).
|