The SSH service module will extract SSH keys from LDAP, optionally create a home directory if it does not already exist, apply any key command limitations specified by the administrator, and atomically overwrite the user's authorized_keys file.
To store the SSH keys in LDAP, we created an sshAccount schema
in our Three Rings Enterprise OID space. The schema is included with
the Splat distribution as schema/ssh.schema
. The
SSH schema defines a new auxiliary object class,
sshAccount and an optional attribute,
sshPublicKey. Additionally,
sshAccount lists uid,
uidNumber, gidNumber, and
homeDirectory as mandatory attributes. Feel free
to use this schema with your own installation.
attributetype ( oooSSHAttributes:1 NAME 'sshPublicKey' DESC 'SSH Public Key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 ) objectclass ( oooSSHClasses:1 NAME 'sshAccount' DESC 'SSH Account' SUP top AUXILIARY MUST ( uid $ uidNumber $ gidNumber $ homeDirectory ) MAY ( sshPublicKey ) )
The SSH service module supports
authorized_keys
command limitations and sanity
checking on the uid, gid, and home directory.
Create home directories for users. Set
to true
to enable home
directory creation, but be aware that other plugins (such as
the homeDirectory
plugin) may
also be configured to create the same home directory, with
different options.
Only write keys to subdirectories of the specified directory.
Do not write keys for uids lower than minuid..
Do note write keys for gids lower than mingid.
Limit user to the specified command.