1

I have a Linux server that authenticates users against an Active Directory. Now interactive logins require username and password and automatic login requires a keytab (Kerberos) for passwordless authentication.

However, I have read in NIST IR 7966 that keytab authentication is not as secure as public/private key pair authentication because in this case you can restrict the access to the execution of a command and you have more control over what systems can the user authenticate.

So, I would like to use public/private key pair and continue authenticating against an Active Directory from a Linux server. Is this possible?

2

Yes, you can require both kerberos and public key authentication with AuthenticationMethods sshd option.

man 5 sshd_config:

AuthenticationMethods

Specifies the authentication methods that must be successfully completed for a user to be granted access. This option must be followed by one or more comma-separated lists of authentication method names. Successful authentication requires completion of every method in at least one of these lists. [...] This option will yield a fatal error if enabled if protocol 1 is also enabled. Note that each authentication method listed should also be explicitly enabled in the configuration.

So, you need to write in your sshd_config something like this:

Protocol 2
GSSAPIAuthentication yes
PubkeyAuthentication yes 

AuthenticationMethods gssapi-with-mic, publickey
  • You may also use "Match User" sections to force pubkey only for specific users if you want to ensure that password/krb authentication can not be used. – Stephen Harris Jun 13 '16 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.