SSH authorized_keys Option & Restriction Generator

What does the SSH authorized_keys Option & Restriction Generator do?

The SSH authorized_keys Option & Restriction Generator allows system administrators, DevOps engineers, and security teams to construct hardened OpenSSH ~/.ssh/authorized_keys lines with granular access controls. It formats forced commands (command="..."), source IP/CIDR subnet whitelists (from="..."), environment variable injections, and security flags (no-pty, no-port-forwarding, no-agent-forwarding, no-X11-forwarding) without syntax errors or invalid whitespace.

Core Concepts

Understanding OpenSSH key restriction parameters in authorized_keys:

• Forced Commands (command="..."): Restricts the public key strictly to executing a specific script or binary (such as rsync --server or automated CI deployment tasks). Any command supplied by the client is ignored and stored in $SSH_ORIGINAL_COMMAND.
• Source IP Whitelisting (from="..."): Rejects connection attempts unless originating from designated static IP addresses, CIDR ranges (e.g. 192.168.1.0/24), or wildcard hostnames (*.corp.internal).
• TTY & Tunneling Hardening: Flags like no-pty prevent interactive shell allocations, while no-port-forwarding and no-agent-forwarding prevent unauthorized network pivots and SSH agent credential theft.

How to use the tool?

1. Paste Public Key: Paste your OpenSSH public key string (e.g. ssh-ed25519 AAAAC3Nza... user@workstation) or click Load Sample.
2. Configure Security Options: Specify forced command paths, source IP addresses/CIDRs, environment variables, and toggle security hardening checkboxes.
3. Generate & Install: Click Generate authorized_keys Line to copy the formatted line or execute the one-line server installer script.

Related Developer Utilities

If you work with SSH keys, server access, and Linux security, explore these complementary tools:

• SSH Public Key Fingerprint Generator: Calculate SHA256 (GitHub) and MD5 (AWS EC2) key fingerprints.
• SSH Public Key Format Converter: Convert OpenSSH keys to RFC 4716 and PEM formats.
• SSH Config to Ansible Inventory Converter: Convert SSH client hosts to Ansible inventory files.
• iptables to UFW Command Converter: Translate legacy firewall rules into UFW scripts.

REST API Integration

Blueutils provides a free REST API endpoint (POST https://blueutils.com/api/ssh/authorized-keys-generator) to programmatically generate restricted authorized_keys lines and server installation commands.

API Request Parameters

API Request Payload Examples

cURL

curl -X POST https://blueutils.com/api/ssh/authorized-keys-generator \
  -H "Content-Type: application/json" \
  -d '{
    "rawText": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt7X2N+h4l7T5rL6H3n8P9Z1m+2q4w6e8r0t2y4u6i8 deployer@ci",
    "options": {
      "command": "/usr/local/bin/ci-deploy.sh",
      "from": "10.0.0.0/16",
      "noPty": true,
      "noPortForwarding": true
    }
  }'

Python

import requests

url = "https://blueutils.com/api/ssh/authorized-keys-generator"
payload = {
    "rawText": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt7X2N+h4l7T5rL6H3n8P9Z1m+2q4w6e8r0t2y4u6i8 deployer@ci",
    "options": {
        "command": "/usr/local/bin/ci-deploy.sh",
        "from": "10.0.0.0/16",
        "noPty": True
    }
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.json())

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String jsonPayload = """
            {
                "rawText": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt7X2N+h4l7T5rL6H3n8P9Z1m+2q4w6e8r0t2y4u6i8 deployer@ci",
                "options": {
                    "noPty": true,
                    "noPortForwarding": true
                }
            }
            """;

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://blueutils.com/api/ssh/authorized-keys-generator"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(jsonPayload))
            .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

API Response Parameters

API Response Payload Examples

Success Response (HTTP 200 OK)

{
  "isValid": true,
  "optionsPrefix": "command=\"/usr/local/bin/ci-deploy.sh\",from=\"10.0.0.0/16\",no-pty,no-port-forwarding",
  "keyType": "ssh-ed25519",
  "comment": "deployer@ci",
  "authorizedKeyLine": "command=\"/usr/local/bin/ci-deploy.sh\",from=\"10.0.0.0/16\",no-pty,no-port-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt7X2N+h4l7T5rL6H3n8P9Z1m+2q4w6e8r0t2y4u6i8 deployer@ci",
  "installCommand": "mkdir -p ~/.ssh && chmod 700 ~/.ssh && echo \"command=\\\"/usr/local/bin/ci-deploy.sh\\\",from=\\\"10.0.0.0/16\\\",no-pty,no-port-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGt7X2N+h4l7T5rL6H3n8P9Z1m+2q4w6e8r0t2y4u6i8 deployer@ci\" >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
}

Validation Failure Response (HTTP 400 Bad Request)

{
  "isValid": false,
  "error": "Invalid SSH public key. Expected format: [options] <key-type> <base64-blob> [comment]"
}

Rate Limit Exceeded Response (HTTP 429 Too Many Requests)

{
  "error": "API rate limit exceeded. Please wait or contact support@blueutils.com."
}

Why use an API to generate restricted authorized_keys lines?

Integrating the SSH authorized_keys Generator API into server provisioning scripts, CI/CD runners, or AI agent tool calling provides key benefits:

• Automated Server Hardening: Dynamically generates restricted authorized_keys lines for ephemeral deployment keys without manual string formatting errors.
• Optimized Token Efficiency for AI Agents: LLMs frequently inject invalid spaces into OpenSSH option strings, which invalidates the key on the server. Calling the API formats option tokens deterministically.
• Deterministic Security Safeguards: Ensures proper comma separation, quote escaping, and correct Unix permission commands (chmod 700 / 600).

Native Usage

How to manage and test authorized_keys restrictions natively:

Linux / Unix (Bash)

# Add restricted key line manually to authorized_keys
mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo 'command="/usr/local/bin/backup.sh",no-pty ssh-ed25519 AAAAC3NzaC... backup@bot' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Test SSH connection with verbose output
ssh -v -i ~/.ssh/id_ed25519 user@server

Windows (PowerShell)

# Create .ssh directory with restricted permissions on Windows OpenSSH Server
$sshDir = "$HOME\.ssh"
if (!(Test-Path $sshDir)) { New-Item -ItemType Directory -Path $sshDir | Out-Null }

$keyLine = 'command="/usr/local/bin/backup.sh",no-pty ssh-ed25519 AAAAC3NzaC... backup@bot'
Add-Content -Path "$sshDir\authorized_keys" -Value $keyLine -Encoding utf8

# Set strict ACL permissions (Windows equivalent of chmod 600)
icacls "$sshDir\authorized_keys" /inheritance:r /grant "$($env:USERNAME):(R,W)"

Windows (Command Prompt)

:: Append restricted key to authorized_keys
if not exist "%USERPROFILE%\.ssh" mkdir "%USERPROFILE%\.ssh"
echo command="/usr/local/bin/backup.sh",no-pty ssh-ed25519 AAAAC3NzaC... backup@bot >> "%USERPROFILE%\.ssh\authorized_keys"

:: Test connection
ssh -v -i "%USERPROFILE%\.ssh\id_ed25519" user@server

Python

Using Python:

def format_authorized_key(pubkey, command=None, from_ip=None, no_pty=True):
    opts = []
    if command: opts.append(f'command="{command}"')
    if from_ip: opts.append(f'from="{from_ip}"')
    if no_pty: opts.append('no-pty')
    prefix = ",".join(opts)
    return f"{prefix} {pubkey}".strip()

print(format_authorized_key("ssh-ed25519 AAAAC3Nza... user@work", command="/app/sync.sh", from_ip="10.0.0.1"))

Java

Using Java:

public class AuthorizedKeysExample {
    public static void main(String[] args) {
        String key = "ssh-ed25519 AAAAC3Nza... user@work";
        String options = "command=\"/app/sync.sh\",no-pty";
        System.out.println(options + " " + key);
    }
}