2

I want a setup where a user home directory is mounted on login (autofs). This is working with password based authentication. However, I want passwordless authentication, by generating public keys.

Passwordless authentication works well if the user's home directory is stored locally (no autofs).

In my case the keys are on the remote server and the home directory is mounted only when accessed and the server cannot verify you unless it has the public key.

Is this even possible?

(Both servers are running Solaris 10 x86 on VirtualBox.)

  • Have you considered auto mounting /home instead of user's home directory ? Maybe there's a reason you don't. – X Tian Feb 23 '14 at 12:38
  • @XTian sorry, I meant user's home directory. I have edited the post to reflect this. And yes, I am trying to do this for specific users not all of them. But even if I automount /home, the users home directory will not be active. It only mounts when he logs in. Correct me If my assumption is incorrect. – mzs_47 Feb 23 '14 at 13:01
  • I'm confused by the need for keys and passwords? I automount the user's home directories using NFS w/o passwords, what tech. are you automounting? – slm Feb 23 '14 at 15:31
  • @slm, what I am trying to achieve is automounting with keys only. Nothing more. I have contrasted automounting with passwords, just to help the prospective reader that there are no other problems :) – mzs_47 Feb 24 '14 at 3:37
  • Sorry I don't think I was clear. What are you automounting that requires the use of keys? I'm familiar w/ NFSv3 + NFSv4 which I automount as well as CIFS, but neither requires keys to my knowledge, are you using something else? – slm Feb 24 '14 at 3:39
1

You could change AuthorizedKeysFile to something outside the home directory, for example /etc/ssh/keys/%u/authorized_keys. Then the keys would be available before /home/%u is mounted.

From the man page of sshd_config:

AuthorizedKeysFile
         Specifies the file that contains the public keys that can be used
         for user authentication.  The format is described in the AUTHO-
         RIZED_KEYS FILE FORMAT section of sshd(8).  AuthorizedKeysFile
         may contain tokens of the form %T which are substituted during
         connection setup.  The following tokens are defined: %% is
         replaced by a literal '%', %h is replaced by the home directory
         of the user being authenticated, and %u is replaced by the user-
         name of that user.  After expansion, AuthorizedKeysFile is taken
         to be an absolute path or one relative to the user's home direc-
         tory.  Multiple files may be listed, separated by whitespace.
         The default is ``.ssh/authorized_keys .ssh/authorized_keys2''.
1

If you have SELinux enabled, you may have to enable NFS mounted home directories via:

setsebool -P use_nfs_home_dirs=true

I had this problem on RHEL, and found the solution in /var/log/messages:

SELinux is preventing /usr/sbin/sshd from read access on the file authorized_keys.#012#012***** Plugin catchall_boolean (89.3 confidence) suggests ******************#012#012If you want to allow use to nfs home dirs#012Then you must tell SELinux about this by enabling the 'use_nfs_home_dirs' boolean.#012You can read 'None' man page for more details.#012Do#012setsebool -P use_nfs_home_dirs 1#012#012*****

  • Unlikely that they are running selinux on Solaris... – Jeff Schaller Sep 27 '16 at 23:43
  • Thanks anyway - I was using EL 7 and started to pursue the answer above but didn't want to mess with standard config. The SE bool fixed it for me and didn't clobber any traditional settings. – BoeroBoy Jan 4 '18 at 10:38
0

This depends on what autofs is mounting. Is it NFS? What security model? If it's AUTH_SYS (IP-based) security, this should work. But if it's krb5, then the SSH server on the host doesn't have a kerberos ticket to mount the directory with.

  • It is NFS. It is using IP based security model. – mzs_47 Aug 15 '15 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.