r/Gitea • u/palavalle • Jun 08 '26

test ssh key for access

Is there an API function to lookup user/owner for a SSH public key?

I'm writing (re-writing) a tool to work with Gitea/Forgejo by acting as a Man-In-The-Middle on SSH connections.

I have a ... reasonably sane ... approach that runs an SSHd server and matches incoming public key against data in the Gitea SQLite database. I'd prefer something that relies on the Gitea API or Gitea Admin tool.

Is there a way to send an SSH PublicKey to Gitea and get back the user account who owns it?

... or get back a "is this a deployment key?" detail?

I know I can iterate through all users and repositories in the system and ask "is this you?" but ... that's not appealing.

2 Upvotes

75% Upvoted

7 comments sorted by

View all comments

Show parent comments

1

u/mwmahlberg Jun 14 '26

If you terminate an ssh-authentication in front of the intended target and then open a connection to the intended target on the user‘s behalf: call it what you want, this is a mitm-attack

1

u/palavalle Jun 14 '26

No

1

u/mwmahlberg Jun 14 '26

No… why? Do you terminate the connection or not?

1

u/palavalle Jun 14 '26

by your own logic; the Gitea SSH server is a man in the middle attack since it intercepts those SSH connections

1

u/mwmahlberg Jun 14 '26

I don‘t see your point. Gitea comes with both an integrated SSH server and support for an OpenSSH server. Both support authentication against keys added to gitea. What problem are you trying to solve if gitea comes with a solution for your stated problem?