I want to setup a ssh server for our users. Our users authenticate against our ldap server with Kerberos encryption, upon which they get access to their home dir's. The ssh server has to listen to the entire world, because our users can be anywhere. So we've decided, we would only allow login with key and configure fail2ban fairly strictly.

The problem with key authentication is that it doesn't work with encrypted home dir's. So I've moved the key authentication outside the users home dir with the "AuthorizedKeysFile" option in sshd_config. The problem then is... the user doesn't get it's home dir on key authentication... of course... they don't request a kerberos principal. How do I configure ssh, so that it does pam authentication after the key login succeeds, so they get they're home dir's too? Does anyone have a good solution for this?


With recent versions of OpenSSH you can require multiple forms of user authentication (AuthenticationMethods). Use that to require both publickey and keyboard-interactive; the latter you configure with ChallengeResponseAuthentication and UsePAM. Then arrange the PAM policy for sshd (often /etc/pam.d/sshd) to use a PAM module which will kinit for the user, e.g. pam_krb5.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.