<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div>I’ve implemented all of this in AsyncSSH, and there I chose to break out the authorized_key parsing from public key parsing. More specifically, AsyncSSH provides the following functions for reading SSH public keys:</div><div><div class="section" id="public-key-support"><div class="section" id="import-private-key"><dl class="function" style="margin-bottom: 15px;"><dd style="margin-top: 3px; margin-bottom: 10px; margin-left: 30px; line-height: 20.799999237060547px;" class=""></dd></dl></div><div class="section" id="import-public-key"><h3 style="font-family: 'Trebuchet MS', sans-serif; background-color: rgb(242, 242, 242); font-weight: normal; color: rgb(32, 67, 92); border-bottom-width: 1px; border-bottom-style: solid; border-bottom-color: rgb(204, 204, 204); margin: 20px -20px 10px; padding: 3px 0px 3px 10px; font-size: 22px;" class="">import_public_key<a class="headerlink" href="http://asyncssh.readthedocs.io/en/latest/api.html#import-public-key" title="Permalink to this headline" style="color: rgb(198, 15, 15); text-decoration: none; visibility: hidden; font-size: 0.8em; padding: 0px 4px;"></a></h3><dl class="function" style="margin-bottom: 15px;"><dt id="asyncssh.import_public_key" class=""><code class="descclassname" style="padding: 0px 1px; font-size: 0.95em;">asyncssh.</code><code class="descname" style="padding: 0px 1px; font-size: 1.2em; font-weight: bold;">import_public_key</code><span class="sig-paren" style="font-size: larger;">(</span><em class="">data</em><span class="sig-paren" style="font-size: larger;">)</span><a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/_modules/asyncssh/public_key.html#import_public_key" style="color: rgb(53, 95, 124); text-decoration: none;"><span class="viewcode-link" style="float: right;">[source]</span></a><a class="headerlink" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.import_public_key" title="Permalink to this definition" style="color: rgb(198, 15, 15); text-decoration: none; visibility: hidden; font-size: 0.8em; padding: 0px 4px;"></a></dt><dd style="margin-top: 3px; margin-bottom: 10px; margin-left: 30px; line-height: 20.799999237060547px;" class=""><p style="margin-top: 0px; line-height: 20.799999237060547px;" class="">Import a public key</p><p style="margin-top: 0px; line-height: 20.799999237060547px;" class="">This function imports a public key encoded in OpenSSH, RFC4716, or PKCS#1 or PKCS#8 DER or PEM format.</p><table class="field-list docutils" frame="void" rules="none" style="margin-bottom: 10px; border: 0px; border-collapse: collapse;"><colgroup class=""><col class="field-name"><col class="field-body"></colgroup><tbody valign="top" class=""><tr class="field-odd field"><th class="field-name" style="padding: 1px 8px 1px 5px; background-color: rgb(238, 221, 238); border: 0px !important;">Parameters:</th><td class="field-body" style="padding: 1px 8px 1px 5px; border: 0px !important;"><strong class="">data</strong> (<em class="">bytes or ASCII string</em>) – The data to import.</td></tr><tr class="field-even field"><th class="field-name" style="padding: 1px 8px 1px 5px; background-color: rgb(238, 221, 238); border: 0px !important;">Returns:</th><td class="field-body" style="padding: 1px 8px 1px 5px; border: 0px !important;">An <a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.SSHKey" title="asyncssh.SSHKey" style="color: rgb(53, 95, 124); text-decoration: none;"><code class="literal py docutils xref py-class" style="padding: 0px 1px; font-size: 0.95em; font-weight: bold;"><span class="pre">SSHKey</span></code></a> public key</td></tr></tbody></table></dd></dl></div><div class="section" id="read-private-key"><dl class="function" style="margin-bottom: 15px;"><dd style="margin-top: 3px; margin-bottom: 10px; margin-left: 30px; line-height: 20.799999237060547px;" class=""></dd></dl></div><div class="section" id="read-public-key"><h3 style="font-family: 'Trebuchet MS', sans-serif; background-color: rgb(242, 242, 242); font-weight: normal; color: rgb(32, 67, 92); border-bottom-width: 1px; border-bottom-style: solid; border-bottom-color: rgb(204, 204, 204); margin: 20px -20px 10px; padding: 3px 0px 3px 10px; font-size: 22px;" class="">read_public_key<a class="headerlink" href="http://asyncssh.readthedocs.io/en/latest/api.html#read-public-key" title="Permalink to this headline" style="color: rgb(198, 15, 15); text-decoration: none; visibility: hidden; font-size: 0.8em; padding: 0px 4px;"></a></h3><dl class="function" style="margin-bottom: 15px;"><dt id="asyncssh.read_public_key" class=""><code class="descclassname" style="padding: 0px 1px; font-size: 0.95em;">asyncssh.</code><code class="descname" style="padding: 0px 1px; font-size: 1.2em; font-weight: bold;">read_public_key</code><span class="sig-paren" style="font-size: larger;">(</span><em class="">filename</em><span class="sig-paren" style="font-size: larger;">)</span><a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/_modules/asyncssh/public_key.html#read_public_key" style="color: rgb(53, 95, 124); text-decoration: none;"><span class="viewcode-link" style="float: right;">[source]</span></a><a class="headerlink" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.read_public_key" title="Permalink to this definition" style="color: rgb(198, 15, 15); text-decoration: none; visibility: hidden; font-size: 0.8em; padding: 0px 4px;"></a></dt><dd style="margin-top: 3px; margin-bottom: 10px; margin-left: 30px; line-height: 20.799999237060547px;" class=""><p style="margin-top: 0px; line-height: 20.799999237060547px;" class="">Read a public key from a file</p><p style="margin-top: 0px; line-height: 20.799999237060547px;" class="">This function reads a public key from a file. See the function <a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.import_public_key" title="asyncssh.import_public_key" style="color: rgb(53, 95, 124); text-decoration: none;"><code class="literal py py-func docutils xref" style="padding: 0px 1px; font-size: 0.95em; font-weight: bold;"><span class="pre">import_public_key()</span></code></a> for information about the formats supported.</p><table class="field-list docutils" frame="void" rules="none" style="margin-bottom: 10px; border: 0px; border-collapse: collapse;"><colgroup class=""><col class="field-name"><col class="field-body"></colgroup><tbody valign="top" class=""><tr class="field-odd field"><th class="field-name" style="padding: 1px 8px 1px 5px; background-color: rgb(238, 221, 238); border: 0px !important;">Parameters:</th><td class="field-body" style="padding: 1px 8px 1px 5px; border: 0px !important;"><strong class="">filename</strong> (<a class="external reference" href="https://docs.python.org/3/library/stdtypes.html#str" title="(in Python v3.5)" style="color: rgb(53, 95, 124); text-decoration: none;"><em class="">str</em></a>) – The file to read the key from.</td></tr><tr class="field-even field"><th class="field-name" style="padding: 1px 8px 1px 5px; background-color: rgb(238, 221, 238); border: 0px !important;">Returns:</th><td class="field-body" style="padding: 1px 8px 1px 5px; border: 0px !important;">An <a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.SSHKey" title="asyncssh.SSHKey" style="color: rgb(53, 95, 124); text-decoration: none;"><code class="literal py docutils xref py-class" style="padding: 0px 1px; font-size: 0.95em; font-weight: bold;"><span class="pre">SSHKey</span></code></a> public key</td></tr></tbody></table></dd></dl></div><div class="section" id="read-private-key-list"><dl class="function" style="margin-bottom: 15px;"><dd style="margin-top: 3px; margin-bottom: 10px; margin-left: 30px; line-height: 20.799999237060547px;" class=""></dd></dl></div><div class="section" id="read-public-key-list"><h3 style="font-family: 'Trebuchet MS', sans-serif; background-color: rgb(242, 242, 242); font-weight: normal; color: rgb(32, 67, 92); border-bottom-width: 1px; border-bottom-style: solid; border-bottom-color: rgb(204, 204, 204); margin: 20px -20px 10px; padding: 3px 0px 3px 10px; font-size: 22px;" class="">read_public_key_list<a class="headerlink" href="http://asyncssh.readthedocs.io/en/latest/api.html#read-public-key-list" title="Permalink to this headline" style="color: rgb(198, 15, 15); text-decoration: none; visibility: hidden; font-size: 0.8em; padding: 0px 4px;"></a></h3><dl class="function" style="margin-bottom: 15px;"><dt id="asyncssh.read_public_key_list" class=""><code class="descclassname" style="padding: 0px 1px; font-size: 0.95em;">asyncssh.</code><code class="descname" style="padding: 0px 1px; font-size: 1.2em; font-weight: bold;">read_public_key_list</code><span class="sig-paren" style="font-size: larger;">(</span><em class="">filename</em><span class="sig-paren" style="font-size: larger;">)</span><a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/_modules/asyncssh/public_key.html#read_public_key_list" style="color: rgb(53, 95, 124); text-decoration: none;"><span class="viewcode-link" style="float: right;">[source]</span></a><a class="headerlink" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.read_public_key_list" title="Permalink to this definition" style="color: rgb(198, 15, 15); text-decoration: none; visibility: hidden; font-size: 0.8em; padding: 0px 4px;"></a></dt><dd style="margin-top: 3px; margin-bottom: 10px; margin-left: 30px; line-height: 20.799999237060547px;" class=""><p style="margin-top: 0px; line-height: 20.799999237060547px;" class="">Read a list of public keys from a file</p><p style="margin-top: 0px; line-height: 20.799999237060547px;" class="">This function reads a list of public keys from a file. See the function <a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.import_public_key" title="asyncssh.import_public_key" style="color: rgb(53, 95, 124); text-decoration: none;"><code class="literal py py-func docutils xref" style="padding: 0px 1px; font-size: 0.95em; font-weight: bold;"><span class="pre">import_public_key()</span></code></a> for information about the formats supported.</p><table class="field-list docutils" frame="void" rules="none" style="margin-bottom: 10px; border: 0px; border-collapse: collapse;"><colgroup class=""><col class="field-name"><col class="field-body"></colgroup><tbody valign="top" class=""><tr class="field-odd field"><th class="field-name" style="padding: 1px 8px 1px 5px; background-color: rgb(238, 221, 238); border: 0px !important;">Parameters:</th><td class="field-body" style="padding: 1px 8px 1px 5px; border: 0px !important;"><strong class="">filename</strong> (<a class="external reference" href="https://docs.python.org/3/library/stdtypes.html#str" title="(in Python v3.5)" style="color: rgb(53, 95, 124); text-decoration: none;"><em class="">str</em></a>) – The file to read the keys from.</td></tr><tr class="field-even field"><th class="field-name" style="padding: 1px 8px 1px 5px; background-color: rgb(238, 221, 238); border: 0px !important;">Returns:</th><td class="field-body" style="padding: 1px 8px 1px 5px; border: 0px !important;">A list of <a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.SSHKey" title="asyncssh.SSHKey" style="color: rgb(53, 95, 124); text-decoration: none;"><code class="literal py docutils xref py-class" style="padding: 0px 1px; font-size: 0.95em; font-weight: bold;"><span class="pre">SSHKey</span></code></a> public keys</td></tr></tbody></table></dd></dl></div><div class="section" id="read-certificate-list"><dl class="function" style="margin-bottom: 15px;"><dd style="margin-top: 3px; margin-bottom: 10px; margin-left: 30px; line-height: 20.799999237060547px;" class=""></dd></dl></div></div><div class="section" id="ssh-agent-support"><span id="index-7" style="font-family: sans-serif; font-size: 16px;" class=""></span></div></div><div><br class=""></div><div>Similar functions are also available for operating on SSH private keys and certificates.</div><div><br class=""></div><div>Then, I have a separate set of functions for operating on data in authorized_key format:</div><div><div class="section" id="authorized-keys"><div class="section" id="import-authorized-keys"><h3 style="font-family: 'Trebuchet MS', sans-serif; background-color: rgb(242, 242, 242); font-weight: normal; color: rgb(32, 67, 92); border-bottom-width: 1px; border-bottom-style: solid; border-bottom-color: rgb(204, 204, 204); margin: 20px -20px 10px; padding: 3px 0px 3px 10px; font-size: 22px;" class="">import_authorized_keys<a class="headerlink" href="http://asyncssh.readthedocs.io/en/latest/api.html#import-authorized-keys" title="Permalink to this headline" style="color: rgb(198, 15, 15); text-decoration: none; visibility: hidden; font-size: 0.8em; padding: 0px 4px;"></a></h3><dl class="function" style="margin-bottom: 15px;"><dt id="asyncssh.import_authorized_keys" class=""><code class="descclassname" style="padding: 0px 1px; font-size: 0.95em;">asyncssh.</code><code class="descname" style="padding: 0px 1px; font-size: 1.2em; font-weight: bold;">import_authorized_keys</code><span class="sig-paren" style="font-size: larger;">(</span><em class="">data</em><span class="sig-paren" style="font-size: larger;">)</span><a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/_modules/asyncssh/auth_keys.html#import_authorized_keys" style="color: rgb(53, 95, 124); text-decoration: none;"><span class="viewcode-link" style="float: right;">[source]</span></a><a class="headerlink" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.import_authorized_keys" title="Permalink to this definition" style="color: rgb(198, 15, 15); text-decoration: none; visibility: hidden; font-size: 0.8em; padding: 0px 4px;"></a></dt><dd style="margin-top: 3px; margin-bottom: 10px; margin-left: 30px; line-height: 20.799999237060547px;" class=""><p style="margin-top: 0px; line-height: 20.799999237060547px;" class="">Import SSH authorized keys</p><p style="margin-top: 0px; line-height: 20.799999237060547px;" class="">This function imports public keys and associated options in OpenSSH authorized keys format.</p><table class="field-list docutils" frame="void" rules="none" style="margin-bottom: 10px; border: 0px; border-collapse: collapse;"><colgroup class=""><col class="field-name"><col class="field-body"></colgroup><tbody valign="top" class=""><tr class="field-odd field"><th class="field-name" style="padding: 1px 8px 1px 5px; background-color: rgb(238, 221, 238); border: 0px !important;">Parameters:</th><td class="field-body" style="padding: 1px 8px 1px 5px; border: 0px !important;"><strong class="">data</strong> (<a class="external reference" href="https://docs.python.org/3/library/stdtypes.html#str" title="(in Python v3.5)" style="color: rgb(53, 95, 124); text-decoration: none;"><em class="">str</em></a>) – The key data to import.</td></tr><tr class="field-even field"><th class="field-name" style="padding: 1px 8px 1px 5px; background-color: rgb(238, 221, 238); border: 0px !important;">Returns:</th><td class="field-body" style="padding: 1px 8px 1px 5px; border: 0px !important;">An <a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.SSHAuthorizedKeys" title="asyncssh.SSHAuthorizedKeys" style="color: rgb(53, 95, 124); text-decoration: none;"><code class="literal py docutils xref py-class" style="padding: 0px 1px; font-size: 0.95em; font-weight: bold;"><span class="pre">SSHAuthorizedKeys</span></code></a> object</td></tr></tbody></table></dd></dl></div><div class="section" id="read-authorized-keys"><h3 style="font-family: 'Trebuchet MS', sans-serif; background-color: rgb(242, 242, 242); font-weight: normal; color: rgb(32, 67, 92); border-bottom-width: 1px; border-bottom-style: solid; border-bottom-color: rgb(204, 204, 204); margin: 20px -20px 10px; padding: 3px 0px 3px 10px; font-size: 22px;" class="">read_authorized_keys<a class="headerlink" href="http://asyncssh.readthedocs.io/en/latest/api.html#read-authorized-keys" title="Permalink to this headline" style="color: rgb(198, 15, 15); text-decoration: none; visibility: hidden; font-size: 0.8em; padding: 0px 4px;"></a></h3><dl class="function" style="margin-bottom: 15px;"><dt id="asyncssh.read_authorized_keys" class=""><code class="descclassname" style="padding: 0px 1px; font-size: 0.95em;">asyncssh.</code><code class="descname" style="padding: 0px 1px; font-size: 1.2em; font-weight: bold;">read_authorized_keys</code><span class="sig-paren" style="font-size: larger;">(</span><em class="">filename</em><span class="sig-paren" style="font-size: larger;">)</span><a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/_modules/asyncssh/auth_keys.html#read_authorized_keys" style="color: rgb(53, 95, 124); text-decoration: none;"><span class="viewcode-link" style="float: right;">[source]</span></a><a class="headerlink" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.read_authorized_keys" title="Permalink to this definition" style="color: rgb(198, 15, 15); text-decoration: none; visibility: hidden; font-size: 0.8em; padding: 0px 4px;"></a></dt><dd style="margin-top: 3px; margin-bottom: 10px; margin-left: 30px; line-height: 20.799999237060547px;" class=""><p style="margin-top: 0px; line-height: 20.799999237060547px;" class="">Read SSH authorized keys from a file</p><p style="margin-top: 0px; line-height: 20.799999237060547px;" class="">This function reads public keys and associated options in OpenSSH authorized_keys format from a file.</p><table class="field-list docutils" frame="void" rules="none" style="margin-bottom: 10px; border: 0px; border-collapse: collapse;"><colgroup class=""><col class="field-name"><col class="field-body"></colgroup><tbody valign="top" class=""><tr class="field-odd field"><th class="field-name" style="padding: 1px 8px 1px 5px; background-color: rgb(238, 221, 238); border: 0px !important;">Parameters:</th><td class="field-body" style="padding: 1px 8px 1px 5px; border: 0px !important;"><strong class="">filename</strong> (<a class="external reference" href="https://docs.python.org/3/library/stdtypes.html#str" title="(in Python v3.5)" style="color: rgb(53, 95, 124); text-decoration: none;"><em class="">str</em></a>) – The file to read the keys from.</td></tr><tr class="field-even field"><th class="field-name" style="padding: 1px 8px 1px 5px; background-color: rgb(238, 221, 238); border: 0px !important;">Returns:</th><td class="field-body" style="padding: 1px 8px 1px 5px; border: 0px !important;">An <a class="internal reference" href="http://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.SSHAuthorizedKeys" title="asyncssh.SSHAuthorizedKeys" style="color: rgb(53, 95, 124); text-decoration: none;"><code class="literal py docutils xref py-class" style="padding: 0px 1px; font-size: 0.95em; font-weight: bold;"><span class="pre">SSHAuthorizedKeys</span></code></a> object</td></tr></tbody></table></dd></dl></div></div><div class="section" id="exceptions"><span id="index-10" style="font-family: sans-serif; font-size: 16px;" class=""></span><span id="id1" style="font-family: sans-serif; font-size: 16px;" class=""></span></div></div><div>Internally, the authorized_key functions use the public key functions, but only after stripping any prefix like “cert-authority” or the various options for limiting when the keys can be used or what SSH actions are allowed when using that key. Then, given an SSH key and some other parameters like the client IP and certificate information the resulting SSHAuthorizedKeys object can then perform matching against all these constraints and return if a key is allowed to be used and what permissions it grants if so.</div><div><br class=""></div><div><br class=""></div><div>On Aug 18, 2016, at 4:04 PM, Chris Hines <<a href="mailto:chris.hines@monash.edu" class="">chris.hines@monash.edu</a>> wrote:<br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class=""><div class="">Hi Paul,<br class=""></div>Options are specified in the sshd man page<br class=""><br class=""><a href="https://www.freebsd.org/cgi/man.cgi?sshd(8)" class="">https://www.freebsd.org/cgi/man.cgi?sshd(8)</a><br class=""><br class=""></div>Under the section Authorized Keys File Format.<br class=""><br class=""></div>Technically options are not part of the public key (so are not covered by RFC4253) but are part of the OpenSSHD authorized_keys file format (which includes everything that can appear in an id_rsa.pub etc and extends it with the options defined in the man page).<br class=""><br class=""></div><div class="">Sadly I don't think there is an RFC for the authorized_keys file (I suspect its OpenSSH specific) but I think we all assume its a de-facto standard :-)<br class=""></div><div class=""><br class="">So at question is whether python-cryptography primitives support only the RFC4253 spec for public key formats or more generally processes lines from an authorized_keys file.<br class=""><br class=""></div><div class="">The fix should be relatively simple. When you split the data into fields (key-type, data and comment) don't assume the first field is key-type, but instead search all fields.<br class=""></div><div class=""><br class=""></div>The particular option *I* am most concerned with is the cert-authority option (a relatively new feature in OpenSSH, but a pretty awesome one IMHO). It gets pre-pended to the key before going in authorized_keys, so a typical entry looks like:<br class=""><br class=""></div><div class="">cert-authority ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMnxAxjwoCQsFJ1SC7+LJeSQCmUi8plJ9nKVmAjKlDr5Z240doRVIBr7+6veFJDPkaFzDxxa4dDn4O1ITXXVrr/JUCQbo4nF3ln4LSGWdDniJxH5uhc7PDYe2FDiiUYLrl4I+n1cB5YSOTDjxERcvXORKKGjPoyYNVuv343a5n7ygIOVTnI9VwTlxKj8gNyMm7wRg+aIJ8yiDwaDqestL9qTGMc+bb8Q0w0OJn8KZoGBYGl7LvS0QNyXsp+5J0GGEuE1c0lp1d5HpgvqRdWeWrlGY5alyQ2BchfJLbUbWQGBP/+kmVZCR022jbEo13/SznECr8ym8cXZzYg+hC1Err hines@tun<br class=""><br class=""></div><div class="">This particular option brings some of the functionality of x509 certificates used for TLS communications (i.e. certifying authorities generating certificates that can be trusted becase you trust the CA) to SSH without bringing the full attack surface of x509 to ssh (at least that was the justification from the OpenSSH authors for not just using x509 :-)<br class=""></div><div class=""><br class=""></div><div class="">Other interesting options include command="..." and no-agent-forwarding,no-port-forwarding<br class=""></div><div class=""><br class=""></div>Ironically I'm not actually certain if this support should be added to python-cryptography, or if it should be added downstream in openstack nova. Technically its part of the authorized_keys file format, not part of the pub key format, and the function in question is pretty clearly named "load_ssh_public_key". On the other hand, it is clear there is some confusion in the wider community of users on the difference between a public key and a line in an authorized_keys file, and perhaps it would be a nice feature to add.<br class=""></div><div class=""><br class=""></div>Cheers,<br class="">--<br class=""></div>Chris.<br class=""></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On 18 August 2016 at 23:08, Paul Kehrer <span dir="ltr" class=""><<a href="mailto:paul.l.kehrer@gmail.com" target="_blank" class="">paul.l.kehrer@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><div style="font-family: Helvetica, Arial; font-size: 13px; margin: 0px;" class="">Hi Chris,</div><div style="font-family: Helvetica, Arial; font-size: 13px; margin: 0px;" class=""><br class=""></div><div style="font-family: Helvetica, Arial; font-size: 13px; margin: 0px;" class="">I don't think we've tried to specifically bound it. In general the assumption has been that the keys it loads would be OpenSSH public keys in the form that you get from an "id_rsa.pub" file (for example).</div><div style="font-family: Helvetica, Arial; font-size: 13px; margin: 0px;" class=""><br class=""></div><div style="font-family: Helvetica, Arial; font-size: 13px; margin: 0px;" class="">What do the options look like? Are they put into the line at the end as comments?</div> <div class=""><br class=""></div>-Paul (reaperhulk)<div class=""><div class="h5"><br class=""> <div class=""></div> <br class=""><p class="">On August 18, 2016 at 8:15:16 AM, Chris Hines (<a href="mailto:chris.hines@monash.edu" target="_blank" class="">chris.hines@monash.edu</a>) wrote:</p> </div></div><blockquote type="cite" class=""><span class=""><div class=""><div class=""></div><div class=""><div class=""><div class="h5">
<div dir="ltr" class="">
<div class="">
<div class="">Hi List,<br class=""></div>
I have a question about the function<br class=""></div>
<div class="">
cryptography.hazmat.primatives<wbr class="">.serialization.load_ssh_<wbr class="">public_key<br class="">
<br class=""></div>
<div class="">Basically is the function inteornded to load only the public
key or is it intended that it be able to process any like out of an
authorized_keys_file<br class="">
<br class=""></div>
<div class="">Source code shows that the function is prepared to strip of
the key-type (eg ssh-rsa) and use it for comparison against the
inner_key_type but is not prepared to strip off any options that
can be passed in an authorized_keys file (For example
SSH_FORCE_COMMAND or no-port-forwarding).<br class="">
<br class=""></div>
<div class="">I ask because the downstream project OpenStack Nova uses
load_ssh_public_key to verify contents intended for authorized_keys
is valid. Its easy enough to remove ssh options in Nova before
passing to load_ssh_public_key, but I though if load_ssh_public_key
already deals with the key-type header, perhaps it should also deal
with the other options.<br class="">
<br class=""></div>
<div class="">I can create issues and merge requests if that is helpful,
just looking for clarification on the intention (i.e. does
load_ssh_public_key load contents intended for authorized_keys or
just the public key part)</div></div></div></div></div></div></span></blockquote></div></blockquote></div></div></div></blockquote></div><div class="">
<span class="Apple-style-span" style="border-collapse: separate; font-variant-ligatures: normal; font-variant-position: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; line-height: normal; border-spacing: 0px;"><div class="">-- </div><div class="">Ron Frederick</div><div class=""><a href="mailto:ronf@timeheart.net" class="">ronf@timeheart.net</a></div><div class=""><br class=""></div></span><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>