0

At my company, we are currently integrating AD authentication to our Linux servers. I've been able to complete this part using PBISO (Power Broker Identity Service). Users are able to login using AD accounts.

We are now taking it a step further and my task is to enable password-less login through public keys. Here is where I am having issues. To achieve this, I pretty much need to stick each user pubkeys to their ~/.ssh/authorized_keys. But it is impractical and super inefficient. I need to find a way to automate this. You may argue that this can be scripted, but I believe this is a deeper rabbit hole. AD home directories cannot be manually created.

One variation I came up with is by redirecting users to a group directory like /home/group1/. So I've created this local user group1 then I added aduser pubkey in /home/group1/.ssh/authorized_keys to test this. When I SSH as aduser, it is asking for password rather than using the key. It only works when I ssh as group1 local user.

Question: can you store public keys to a local user ~/.ssh/authorized_keys and login as a different user? If this is doable, how can I get this to work?

My goal is to have users login using their AD accounts, redirect to /home/group1/ and use the authorized_keys for password-less authentication.

Any input is appreciated. Thank you.

  • where are they login from ? a PC under windows ? if yes they already have an AD and can use credentials to go to unix, just tell putty (or it's equivalent) to use AD credentials. – Archemar May 27 at 20:37
  • Mostly Windows. This might be feasible. I've read about this (using gssapi) but I could not get Putty or Mobaterm working. Can you please point me to any how to article or troubleshooting guide? This might be a better approach. – swfplayer May 27 at 22:18
  • Are you aware that you can bypass the authorized_keys file entirely and instead, when a user attempts login, ssh_server will execute a script to pull the keys from wherever you like? – Philip Couling May 27 at 23:07
  • ... this is the canonical way to enable LDAP single sign on with public keys. It should be trivial to translate the same principle into PBISO as long as your Linux servers have access to get users' public keys. See here serverfault.com/a/653793/94158 – Philip Couling May 27 at 23:12
  • @PhilipCouling i thought of it but had not been successful. can you help/point me on how to build a script that will pull keys for authentication say stored in /etc/ssh/authorized_keys? adsuser logs in, ssh runs AuthorizedKeysCommand /keychecker.sh, finds the key and logs in the user without entering password. – swfplayer May 28 at 16:01
0

I found a solution to my task and thanks to @PhilipCouling input.

I've enabled AuthorizedKeysCommand and AuthorizedKeysCommandUser in /etc/ssh/sshd_config to run a look up script that will fetch public keys.

AuthorizedKeysCommand /sshkey-check.sh AuthorizedKeysCommandUser root

In this script, I added user keys in a hash array and echo the corresponding key for authentication.

I.e: ssh domain\aduser1@centosbox

#!/bin/bash

declare -A keys

# remove the domain name and the backslash from the username entered, i.e. domain\
user=$(echo $1 | sed 's@.*\\@@') 

keys[aduser1]="public key"
keys[aduser2]="public key"
keys[aduser3]="public key"

echo ${keys[${user}]}
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.