Configure GitHub public-key SSH access
What it does
Configures the non-root user who invokes this script through sudo for SSH access on one Debian 13 (Trixie) x86_64 server. It fetches that user's public SSH keys from one GitHub username immediately, then again at 00:00, 04:00, 08:00, 12:00, 16:00, and 20:00 in the server's local timezone. Each successful fetch atomically replaces the target user's ~/.ssh/authorized_keys, so removed GitHub keys lose access at the next refresh.
The script also changes SSH authentication for the entire server: it requires public-key authentication and disables password, keyboard-interactive, GSSAPI, host-based, and empty-password authentication. Existing SSH users must already have a working public key before this runs. It installs Debian's curl package if needed, adds a root-owned sync helper and systemd service/timer, creates /etc/ssh/sshd_config.d/99-github-publickey-only.conf, validates the full SSH configuration, and reloads ssh.service only after validation succeeds.
Run this directly from the intended non-root account. It prompts for that account's sudo password when it needs elevated access. Keep the current SSH session open until a new public-key login has succeeded. This is public-key-only authentication, not OpenSSH user-certificate authentication: GitHub profile keys are ordinary public keys and are the sole managed access source for the target account.
System: Debian 13 x86_64
bash -c "$(curl -fsSL 'https://hero4hire.com/scripts/debian-13-x86_64/configure-github-ssh-access.sh')"Show script
Loading script…How it works
The script derives the account from the current non-root shell and prompts with sudo -v before making privileged changes. When it is already running through sudo, it uses SUDO_USER; direct-root execution is rejected. This prevents a copied command from silently configuring root or an unintended account. It validates the operating system, CPU architecture, account home directory, SSH daemon, and GitHub username before changing anything. curl is the only package it may install; it is Debian's standard HTTPS transfer client and is required for periodic downloads.
The root-owned helper is started by systemd as the target user, so its recurring write to ~/.ssh/authorized_keys cannot acquire root privileges through a user-controlled home directory. The helper downloads GitHub's public-key text endpoint over HTTPS, requires a nonempty key set that ssh-keygen can parse, then renames a temporary file in the same directory into place. A network error, missing profile, or malformed response therefore preserves the last known-good keys.
The timer uses an OnCalendar expression for six four-hourly runs each day and Persistent=true to catch up once after a missed calendar event. The initial service run must succeed before the script installs the SSH policy. The managed drop-in is then tested with sshd -t; a failed test restores the prior version and does not reload the daemon. A reload, rather than restart, avoids needlessly terminating existing SSH sessions.
The script is rerunnable: rerunning it replaces the managed helper, configuration, service, and timer and retries the initial key refresh. If an earlier helper failed with curl: (3) URL rejected: Bad hostname, rerun the corrected script from the same non-root account. That failure occurred before the installer enabled the timer or changed SSH authentication on that run; an existing timer or SSH policy from an earlier run remains in place.
AuthenticationMethods publickey is the setting that makes public-key authentication mandatory. The related settings disable other interactive and network authentication methods explicitly. This affects every SSH account on the host; it does not disable root public-key authentication or manage other users' authorized keys.
Commands Used
| Command | Argument | Description |
|---|---|---|
id | -u, -un, -gn | Identifies the invoking account and obtains its primary group. |
sudo | -v | Prompts once for authorization and refreshes credentials before privileged operations. |
getent | passwd | Reads the target user's configured home directory from the account database. |
apt-get | update | Refreshes package metadata only when curl is absent. |
install --yes curl | Installs the HTTPS client needed for the initial and scheduled key refreshes. | |
install | -d, -m, -o, -g | Creates managed directories and files with the required owner and permissions. |
curl | --fail --location --proto '=https' --tlsv1.2 | Retrieves only successful HTTPS responses from the selected GitHub account's key endpoint. |
ssh-keygen | -l -f | Ensures downloaded data is parseable SSH public-key material before replacing access keys. |
systemctl | daemon-reload, start, enable --now, reload | Loads, runs, schedules, and safely reloads the service configuration. |
sshd | -t | Validates the complete SSH daemon configuration before it is reloaded. |
cp | --archive | Preserves the previous managed SSH drop-in for rollback after validation failure. |
mv | -f | Atomically replaces the authorized keys file and restores a previous SSH drop-in when needed. |
References
Debian's OpenSSH server configuration manual documents AuthenticationMethods, SSH authentication controls, Match behavior, and Debian's sshd_config.d include path. Debian's systemd timer manual documents OnCalendar and Persistent. GitHub's REST API documentation for public user SSH keys documents public SSH-key retrieval for a username. Debian's curl package page documents the installed HTTPS client.