[kwlug-help] RH Directory Server/389 Directory Server and SSH key management

Steve Ovens steve_ovens at linux.com
Fri May 10 15:36:27 EDT 2013


Hi guys,

I have been quite happily using 389 for around a year, and while I am not
at all advanced I have been able to add Samba and sudoers to 389. I am now
attempting to add openssh keys to the user entries I am using the
openssh-lpk_openldap.schema:


#
# LDAP Public Key Patch schema for use with openssh-ldappubkey
# Author: Eric AUGE <eau at phear.org>
#
# Based on the proposal of : Mark Ruijter
#


# octetString SYNTAX
attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
    DESC 'MANDATORY: OpenSSH Public key'
    EQUALITY octetStringMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )

# printableString SYNTAX yes|no
objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top
AUXILIARY
    DESC 'MANDATORY: OpenSSH LPK objectclass'
    MAY ( sshPublicKey $ uid )
    )


I have run this through the ol-schema-migrate.pl and placed the output in
/etc/dirsrv/slapd-ds/schema/
62sshkeys.ldif.

I have restarted the server and there were no errors produced so I am
assuming that it took the ldif fine.

However, even after reading the Administration guide on the RedHat site, I
am unsure how to link the new attributes to a user.

Is anyone using a Directory Server? Some have suggested freeipa, however
that is not a good solution because I am trying to move away from Winbind
<-> AD. Additionally freeipa does not sync groups which is also a bit of a
problem.

Does anyone have any experience with LDAP and SSH keys?

I appreciate any responses.

-- 
Red Hat Certified Engineer
Ubuntu Certified Professional
Novell Datacenter Specialist
Novell Certified Linux Administrator
LPIC-1 Certified
Linux+ Certified
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://kwlug.org/pipermail/kwlug-help_kwlug.org/attachments/20130510/37094ba2/attachment.html>


More information about the kwlug-help mailing list