Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to setup a ssh server for our users. Our users authenticate against our ldap server with Kerberos encryption, upon which they get access to their home dir's. The ssh server has to listen to the entire world, because our users can be anywhere. So we've decided, we would only allow login with key and configure fail2ban fairly strictly.

The problem with key authentication is that it doesn't work with encrypted home dir's. So I've moved the key authentication outside the users home dir with the "AuthorizedKeysFile" option in sshd_config. The problem then is... the user doesn't get it's home dir on key authentication... of course... they don't request a kerberos principal. How do I configure ssh, so that it does pam authentication after the key login succeeds, so they get they're home dir's too? Does anyone have a good solution for this?

share|improve this question

With recent versions of OpenSSH you can require multiple forms of user authentication (AuthenticationMethods). Use that to require both publickey and keyboard-interactive; the latter you configure with ChallengeResponseAuthentication and UsePAM. Then arrange the PAM policy for sshd (often /etc/pam.d/sshd) to use a PAM module which will kinit for the user, e.g. pam_krb5.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .