# Pritunl zero ssh - all users?
**URL:** https://forum.pritunl.com/t/pritunl-zero-ssh-all-users/403
**Category:** Pritunl Zero
**Tags:** pritunl-zero
**Created:** [September 22, 2022, 6:01pm UTC](https://forum.pritunl.com/t/pritunl-zero-ssh-all-users/403 "2022-09-22T18:01:14Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@dskillin](https://forum.pritunl.com/u/dskillin)
#### Post date: [September 22, 2022, 6:01pm UTC](https://forum.pritunl.com/t/pritunl-zero-ssh-all-users/403/1 "2022-09-22T18:01:14Z")
SERVER: domain
SSH\_KEY: ~/.ssh/id\_rsa.pub
OPEN: domain/ssh?ssh-token=REDACTED
CERTIFICATE: ~/.ssh/id\_rsa-cert.pub
SSH\_CONFIG: ~/.ssh/config
Successfully validated SSH key
ssh -i id\_rsa.pub user@host.x.y
Any username works… user1, root, user2, etc…
How does the cert get bound to a single user, or is this a bug?
---
### Author:  [@zach](https://forum.pritunl.com/u/zach)
#### Post date: [September 22, 2022, 6:23pm UTC](https://forum.pritunl.com/t/pritunl-zero-ssh-all-users/403/2 "2022-09-22T18:23:27Z")
The SSH server will control access. There are multiple options available for matching in SSH configuration files. Below is example in `/etc/ssh/sshd_config` of matching different principals which are referred to as roles in Pritunl Zero for user `example1` and `example2`. The `/etc/ssh/principals_example1` and `/etc/ssh/principals_example2` files can then contain a list of Pritunl Zero roles that will permit access to that user if the Pritunl Zero user has a matching role. The `Match all` line will close out the previous `Match` statement. There are multiple `Match` paremeters available including `Match host` to create rules for specific client IP addresses.
```auto
Match user example1
TrustedUserCAKeys /etc/ssh/trusted
AuthorizedPrincipalsFile /etc/ssh/principals_example1
Match user example2
TrustedUserCAKeys /etc/ssh/trusted
AuthorizedPrincipalsFile /etc/ssh/principals_example2
Match all
```
---
### Author:  [@dskillin](https://forum.pritunl.com/u/dskillin)
#### Post date: [September 22, 2022, 7:30pm UTC](https://forum.pritunl.com/t/pritunl-zero-ssh-all-users/403/3 "2022-09-22T19:30:29Z")
If I have 200 users who may need access, and I want attribution to each of the users – I would need 200 user matches configured across each system? Basically assigning a named role for each?
---
### Author:  [@zach](https://forum.pritunl.com/u/zach)
#### Post date: [September 22, 2022, 8:30pm UTC](https://forum.pritunl.com/t/pritunl-zero-ssh-all-users/403/4 "2022-09-22T20:30:23Z")
The system is designed around role based access with groups of users being assigned different roles. Each user would need to be assigned a unique role to control access for individual users.
---
### Author:  [@avid-fan](https://forum.pritunl.com/u/avid-fan)
#### Post date: [March 17, 2023, 6:45pm UTC](https://forum.pritunl.com/t/pritunl-zero-ssh-all-users/403/5 "2023-03-17T18:45:26Z")
Hi [dskillin](https://forum.pritunl.com/u/dskillin),
We’re evaluating Pritunl Zero, run into same issue. Figured a workaround but it requires clunky sidecar with extraneous access to the database or patching pritunl and we’re not really fond of maintaining our own fork. Sadly that failure to differentiate users feels to be considered a feature not a bug 🙁
We like the system _very_ much, hoping Zach will figure out a better way of dealing with the problem.
> [@Pritunl-zero ssh bastion allows to login as any user?](https://forum.pritunl.com/t/pritunl-zero-ssh-bastion-allows-to-login-as-any-user/868/5):
>
> I don’t think there is any option to associate a Linux user with a specific Pritunl Zero user If you see my previous post, please, if we encode username in the certificate or find a way to validate user id with pritunl-zero server, that would work, right?.. I mean I thought of: giving the bastion read only access to mongodb to query for user Id; considered this a really bad idea developing a service real quick that would run along with pritunl-zero query the database and validate accounts…
---
### Author:  [@zach](https://forum.pritunl.com/u/zach)
#### Post date: [March 18, 2023, 11:14pm UTC](https://forum.pritunl.com/t/pritunl-zero-ssh-all-users/403/6 "2023-03-18T23:14:40Z")
I’m not aware of any option with SSH to get each Pritunl Zero user to map to Linux users without adding client software on every server. Installing a client on every server just to get users mapped isn’t likely to have a lot of usage by users.