Central user management with multiple servers with SSH keys, LDAP?

the number of my servers and users is growing and I would like to adopt a central database to manage users accounts. I'm thinking about OpenLDAP, but I have a question.

Is it possible in LDAP to somehow restrict specific users to access only certain servers? For example, I have servers A, B, C, D and E and users 1 to 20. Let us say that users 1-5 can access servers B and D, users 6-10 servers A, B and E, users 11-20 to all of the servers. Can I enforce this somehow in LDAP or any other central database?

Is there a better solution than LDAP? I would also like to centrally manage SSH keys for my users. I know that there is a schema to do this in LDAP, but is there an alternative better soultion to this situation?

Best Regards
Kamil

• If nothing else, your ssh servers could use the AuthorizedKeysCommand directive to generate a virtual authorized_keys on the fly, using whatever information, data storage and caching you choose. – Ulrich Schwarz Jan 7 '18 at 16:40

2 Answers

LDAP could certainly contain various unix groups for all your various users, though access restriction would be more typically be done in the SSH (or possibly PAM) configuration files, so you would also need something that can manage those configuration files (or SSH keys) on each individual machine. Configuration management software does this, and may also replace the use of LDAP if user management and group is instead done via that. You could try to place everything into LDAP, but there's likely diminishing returns on how effective that is versus a mixed LDAP/configuration management or no LDAP all configuration management setup.

There is little "better" here, only tradeoffs between shoving the necessary complexity into LDAP and the benefits/problems of that (someone once pointed The Website at corporate LDAP which melted corporate LDAP dead and then nobody could login or look at wikis or check dashboards...hilarity!), or into configuration management and benefits/problems there, or a mixture of both...

While you could in theory use any database-backend with custom NSS/PAM integration using a LDAP server is the right solution because there are ready-to-use solutions.

Æ-DIR

That's pretty much the use-case my own solution was designed for, completely based on free software:

Æ-DIR -- Authorized Entities Directory

Mainly systems/services are members of service groups and you define which user groups have login right to the service group.

It's a bit of indirection implemented with OpenLDAP ACLs granting read access to users and groups and especially user attributes needed for login. To avoid a common misunderstanding: You will just maintain LDAP entries to change access rights; the OpenLDAP ACLs are static.

To be honest there's one thing you have to configure in the LDAP client: A system credential, either bind-DN and password or TLS client cert.

It will take some time to understand the concepts and model the data to match your access control requirements. And pretty sure it will not fulfill all your wishes regarding access control.

P.S.: I'd like to hear of people having large setups with host access control based on netgroups because I'd like to find out whether it would be possible to write an auto-migration tool for converting netgroup maps into Æ-DIR's aeSrvGroup.

FreeIPA

FreeIPA has similar goals and they implement so-called HBAC policies and some more to achieve that. From my understanding you would have to use sssd with IPA backend to make use of the full feature set. sssd is the policy enforcement point.

Sorry, I'm not familiar enough with their online docs and thus don't have good documenation links at hand besides the FreeIPA docs overview.

• Please post the answer here, not just a link. – G-Man Jul 20 '18 at 23:45
• I'm new here and wanted to avoid redundant text. Edited my answer accordingly. – Michael Ströder Jul 21 '18 at 11:34