# Pritunl-zero ssh bastion allows to login as any user?

**URL:** <https://forum.pritunl.com/t/pritunl-zero-ssh-bastion-allows-to-login-as-any-user/868>\
**Category:** Pritunl Zero\
**Tags:** pritunl-zero\
**Created:** [March 16, 2023, 12:19pm UTC](https://forum.pritunl.com/t/pritunl-zero-ssh-bastion-allows-to-login-as-any-user/868 "2023-03-16T12:19:52Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![avid-fan](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/a/848f3c/32.png) [@avid-fan](https://forum.pritunl.com/u/avid-fan)\
**Post date:** [March 16, 2023, 6:38pm UTC](https://forum.pritunl.com/t/pritunl-zero-ssh-bastion-allows-to-login-as-any-user/868/5 "2023-03-16T18:38:52Z")

</div>

> I don’t think there is any option to associate  
> a Linux user with a specific Pritunl Zero user

If you see my previous post, please, if we encode username in the certificate or find a way to validate user id with pritunl-zero server, that would work, right?..

I mean I thought of:

- giving the bastion read only access to mongodb to query for user Id; considered this a really bad idea
- developing a service real quick that would run along with `pritunl-zero` query the database and validate accounts; consider this to defy entire idea of SSH certificates
- patching `pritunl-zero` to encode needed information in the certificate; liked this idea the most

I’m now running on a patched version of `pritunl-zero` right now (encoding `usr.Username` instead of `usr.Id` and on the bastion use a command that validates not only principals but also matches `KeyID` with login username). It’s working pretty well.

Trouble is that I don’t really feel like maintaining my fork and hoping you could figure out even better way to deal with the trouble.

---

_[View the full topic](https://forum.pritunl.com/t/pritunl-zero-ssh-bastion-allows-to-login-as-any-user/868)._