Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to setup a ssh server for our users. Our users authenticate against our ldap server with Kerberos encryption, upon which they get access to their home dir's. The ssh server has to listen to the entire world, because our users can be anywhere. So we've decided, we would only allow login with key and configure fail2ban fairly strictly.

The problem with key authentication is that it doesn't work with encrypted home dir's. So I've moved the key authentication outside the users home dir with the "AuthorizedKeysFile" option in sshd_config. The problem then is... the user doesn't get it's home dir on key authentication... of course... they don't request a kerberos principal. How do I configure ssh, so that it does pam authentication after the key login succeeds, so they get they're home dir's too? Does anyone have a good solution for this?

share|improve this question

1 Answer 1

With recent versions of OpenSSH you can require multiple forms of user authentication (AuthenticationMethods). Use that to require both publickey and keyboard-interactive; the latter you configure with ChallengeResponseAuthentication and UsePAM. Then arrange the PAM policy for sshd (often /etc/pam.d/sshd) to use a PAM module which will kinit for the user, e.g. pam_krb5.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.