SSH PKI authentication

Question

At my company, we are currently integrating AD authentication to our Linux servers. I've been able to complete this part using PBISO (Power Broker Identity Service). Users are able to login using AD accounts.

We are now taking it a step further and my task is to enable password-less login through public keys. Here is where I am having issues. To achieve this, I pretty much need to stick each user pubkeys to their ~/.ssh/authorized_keys. But it is impractical and super inefficient. I need to find a way to automate this. You may argue that this can be scripted, but I believe this is a deeper rabbit hole. AD home directories cannot be manually created.

One variation I came up with is by redirecting users to a group directory like /home/group1/. So I've created this local user group1 then I added aduser pubkey in /home/group1/.ssh/authorized_keys to test this. When I SSH as aduser, it is asking for password rather than using the key. It only works when I ssh as group1 local user.

Question: can you store public keys to a local user ~/.ssh/authorized_keys and login as a different user? If this is doable, how can I get this to work?

My goal is to have users login using their AD accounts, redirect to /home/group1/ and use the authorized_keys for password-less authentication.

Any input is appreciated. Thank you.

Answer 1

I found a solution to my task and thanks to @PhilipCouling input.

I've enabled AuthorizedKeysCommand and AuthorizedKeysCommandUser in /etc/ssh/sshd_config to run a look up script that will fetch public keys.

AuthorizedKeysCommand /sshkey-check.sh AuthorizedKeysCommandUser root

In this script, I added user keys in a hash array and echo the corresponding key for authentication.

I.e: ssh domain\aduser1@centosbox

#!/bin/bash

declare -A keys

# remove the domain name and the backslash from the username entered, i.e. domain\
user=$(echo $1 | sed 's@.*\\@@') 

keys[aduser1]="public key"
keys[aduser2]="public key"
keys[aduser3]="public key"

echo ${keys[${user}]}