jirutka/ssh-ldap-pubkey

Login process without creating first the users

mariusmitrofan opened this issue · 5 comments

mariusmitrofan commented

Hey guys,

This process works just fine if:

  • the useradd random_user command was run on the server (prior to user's attempt to log in)
  • the random_user has an entry in LDAP with a correct sshPublicKey value set up

Hooray!

However...
Is there a process for this to work without first creating the users locally?

You guys would probably save my life if there is such a thing :)

Thanks,
Marius

mariusmitrofan commented

This is my /etc/ssh/sshd_config file btw:

HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
SyslogFacility AUTHPRIV
PermitRootLogin forced-commands-only
AuthorizedKeysFile /dev/null
AuthorizedKeysCommand /usr/bin/ssh-ldap-pubkey-wrapper
AuthorizedKeysCommandUser nobody
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding yes
PrintLastLog yes
UsePrivilegeSeparation sandbox
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
Subsystem sftp  /usr/libexec/openssh/sftp-server
LogLevel INFO

And I'm running :

[root@ip-172-27-65-235 ec2-user]# cat /etc/*-release
NAME="Amazon Linux AMI"
VERSION="2017.03"
ID="amzn"
ID_LIKE="rhel fedora"
VERSION_ID="2017.03"
PRETTY_NAME="Amazon Linux AMI 2017.03"
ANSI_COLOR="0;33"
CPE_NAME="cpe:/o:amazon:linux:2017.03:ga"
HOME_URL="http://aws.amazon.com/amazon-linux-ami/"
Amazon Linux AMI release 2017.03
maretodoric commented

Nice that actually someone bothered to answer you.
Are you trying to login as that 'random_user' or some other user?

For example, if you want to login as user 'root' you just need 'root' created in LDAP and there you can add multiple ssh keys for root user.
As for trying to login as user which does not exist, no, probably not without some other external plugins MAYBE.

mariusmitrofan commented

I was able to fix this on my own, but do appreciate taking your time to look into this.

Resolution: Use a sshwrapper script and ensure that the "authconfig" commands creates home folders for the users.

mariusmitrofan commented

Packages installed:

          - gcc
          - python27-devel
          - openldap-devel
          - python27-pip
          - openldap-clients
          - nss-pam-ldapd

Commands ran:

          - pip install python-ldap
          - authconfig --enableldap --enableldapauth --ldapserver=${LdapHostname} --ldapbasedn="ou=People,dc=${Domain},dc=com" --update
          - authconfig --enablemkhomedir --update
          - ln -sf /home /users
jirutka commented

Use a sshwrapper script and ensure that the "authconfig" commands creates home folders for the users.

What do you mean by sshwrapper script? Some script that you set as AuthorizedKeysCommand which creates the user and calls ssh-ldap-pubkey?