Back to the main page

SSH Key in 389 Directory Server

Server

Schema is defined in the file 98openssh-ldap.ldif and placed in directory /etc/dirsrv/slapd-389-ds/schema/ 
# openssh-ldap schema for 389
# note, it's bit different then for openldap
dn: cn=schema
#
attributetypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13
        NAME 'sshPublicKey'
        DESC 'MANDATORY: OpenSSH Public key'
        EQUALITY octetStringMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.40
        )
#
objectclasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0
        NAME 'ldapPublicKey' SUP top AUXILIARY
        DESC 'MANDATORY: OpenSSH LPK objectclass'
        MUST uid
        MAY sshPublicKey
        )

Verify ownership and permissions. 
[root@389-ds schema]# chown ldapadmin:ldapadmin 98openssh-ldap.ldif ; chmod 440 98openssh-ldap.ldif

Restart dirsrv service. 
[root@389-ds schema]# service dirsrv restart
Shutting down dirsrv:
    ca-eval-389-1...                [  OK  ]
Starting dirsrv:
    ca-eval-389-1...                [  OK  ]

Or 
[root@389-ds schema]# systemctl restart dirsrv.target
[root@389-ds schema]# systemctl status dirsrv.target
  dirsrv.target - 389 Directory Server
   Loaded: loaded (/usr/lib/systemd/system/dirsrv.target; enabled; vendor preset: disabled)
   Active: active since Fri 2016-05-13 11:47:22 PDT; 2s ago
May 13 11:47:22 389-ds systemd[1]: Reached target 389 Directory Server.
May 13 11:47:22 389-ds systemd[1]: Starting 389 Directory Server.

Relogin to the Console is needed in order to see new ObjectClasses and Attributes.






User's keys can be added via the GUI, first add ObjectClass, then add Attribute.






A user's key can also be added via CLI, for example create file username-changesshkey.ldif that reads: 
dn: uid=zare,l=amer,dc=business,dc=com
changeType: modify
add: sshPublicKey
sshPublicKey: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwXSh2Ho6ujRA7vEL.......Tu1dKm0twFcj+bb611moU1Ynw== zare@server1
sshPublicKey: ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEA+iO5Ujd+uYhW9PBNy.........OrnhB+O6Ets59Ad/O8= rsa-key-20150217

And modify ldap entry by running the command: 
[root@389-ds tmp]# ldapmodify -x -W -D "cn=Directory Manager" -f username-changesshkey.ldif
Enter LDAP Password:
modifying entry "uid=zare,l=amer,dc=business,dc=com"

Client

RPMs needed for client: openldap-clients, pam_ldap, openldap, nss-pam-ldapd, arp-util-ldap, openldap-devel. Use comamnd "authconfig" to configure authentication resources. 
# yum install authconfig
# authconfig --enableldap --enableldapauth --ldapserver=389-ds.business.com --ldapbasedn="dc=business,dc=com" --enablemkhomedir --update

The /etc/openldap/ldap.conf needs: 
BASE    dc=business,dc=com
URI     ldap://389-ds.business.com

The /etc/nsswitch.conf needs: 
passwd:     files ldap
shadow:     files ldap
group:      files ldap

The /etc/ssh/sshd_config needs: 
PubkeyAuthentication yes
AuthorizedKeysCommand /usr/local/bin/get-sshkey-from-ldap.sh

The script "get-sshkey-from-ldap.sh" reads: 
#!/bin/sh
 ldapsearch -x '(&(objectClass=ldapPublicKey)(uid='"$1"'))' 'sshPublicKey' | \
    sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'

... and this is how SSHD query user's public key from Ldap. To test this script, run it with user account as argument, you should see user's key(s). 
# /usr/local/bin/get-sshkey-from-ldap.sh zare
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwXSh2H...shortened...8ksoySiZCzomKuHgpehLDX27o3stqXSCTu1dKm0twFcj+bb611moU1Ynw==
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEA+iO5Ujd...shortened ...XyfdbXGoffRM238f/vpqGvYCWIk9ccbxt95etl4OrnhB+O6Ets59Ad/O8=


Back to the main page