0

I would like to enable the following: Linux ec2 instances in AWS that perform LDAP authentication of users who have no home directory currently on the box. I have a working openLDAP in AWS for the task

Once LDAP authenticated:

  • The user's home directory will get created
  • The user's public ssh key is retrieved from their sshPublicKey attribute in LDAP and they can only log on if their local sshPrivateKey matches

I know how to do LDAP auth OR retrieval of public key via an ldapsearch but I want to do both.

The scenario I am trying to mitigate against is when an employee leaves the company: I can just disable their account in openLDAP and even if their public key exists on machines, they won't be able to use them because they will also fail ldap auth.

I've hunted round on StackExchanges and don't think I've found what I'm looking for. The closest I've come is

https://serverfault.com/questions/653792/ssh-key-authentication-using-ldap

https://serverfault.com/questions/579341/combination-of-ssh-key-auth-and-two-factor-authentication

1 Answer 1

1

First of all the authorized keys should not be stored in user's home directory for two reasons:

  1. The users should not be allowed to add random authorized keys themselves.
  2. During first login, if the home directory does not exist yet, the authorized key should already be there.

You should rather set AuthorizedKeysFile like this to let sshd read the authorized keys from a locked down directory where you place keys via a helper sync script:

AuthorizedKeysFile /etc/ssh/authorized_keys/%u

A variant of this is using AuthorizedKeysCommand to trigger some dynamic retrieval of authorized keys. Bear in mind that network might be down or a system unreachable right at the time you have to login.

In case the employee leaves you also remove the authorized keys.

If you still want to enforce using key- and password-based authentication you can set AuthenticationMethods like this:

AuthenticationMethods publickey,password

Note the comma used as separator instead of a space.

(If you don't want to deal with all the details yourself you could setup a ready-to-use solution like FreeIPA with sssd as NSS/PAM client or my Æ-DIR with aehostd used as NSS/PAM client.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .