Hello there
Not sure that this is feasable nor that this is the right place to submit this question but I think it is.
I use sssd to deal with authentication on my linux boxes : OK
I also know how to use external SASL_MECH to bind my ldap server : I have produced and install a certificate with an appropriate subject and signed it by a CA that is known by my ldap server. Like this, I can bind the server over TLS with my identity and without providing any passwd.
$ ldapsearch -ZZ uid=olivier SASL/EXTERNAL authentication started SASL username: 0.9.2342.19200300.100.1.1=guillard,ou=staff,dc=example,dc=fr SASL SSF: 0 ...response...
Right : nothing new.
I was now wondering if there would have any way to annonce my certificate using the "external SASL_MECH" mechanism over a login process to a linux box (let say using ssh), so that pam would not ask me to type a "login" and a "password" to log in ?
Don't hesitate to fire if my question is stupid.
Thanks,
--- Olivier
PS, to rephrase that : I'm looking for a way to use a personnal key to login without having to provide a password. ssh keys are not the right solution because I would need to install the public key in every authorized_key on my network ( I would like a centralized solution ).
I also found this : http://code.google.com/p/openssh-lpk/
But I don't want to patch ssh if possible since I highly prefere to use standard tools provided as much as possible
I'm on RedHat6
On 03/28/2012 09:59 AM, Olivier wrote:
Hello there
Not sure that this is feasable nor that this is the right place to submit this question but I think it is.
I use sssd to deal with authentication on my linux boxes : OK
I also know how to use external SASL_MECH to bind my ldap server : I have produced and install a certificate with an appropriate subject and signed it by a CA that is known by my ldap server. Like this, I can bind the server over TLS with my identity and without providing any passwd.
$ ldapsearch -ZZ uid=olivier SASL/EXTERNAL authentication started SASL username: 0.9.2342.19200300.100.1.1=guillard,ou=staff,dc=example,dc=fr SASL SSF: 0 ...response...
Right : nothing new.
I was now wondering if there would have any way to annonce my certificate using the "external SASL_MECH" mechanism over a login process to a linux box (let say using ssh), so that pam would not ask me to type a "login" and a "password" to log in ?
Don't hesitate to fire if my question is stupid.
Thanks,
Olivier
PS, to rephrase that : I'm looking for a way to use a personnal key to login without having to provide a password. ssh keys are not the right solution because I would need to install the public key in every authorized_key on my network ( I would like a centralized solution ).
I also found this : http://code.google.com/p/openssh-lpk/
But I don't want to patch ssh if possible since I highly prefere to use standard tools provided as much as possible
I'm on RedHat6
Are you sshing from Windows or Linux? I am not sure how you can do it with just a key or a cert. SSH does not support cert authentication but in RHEL there have been some patches to support X509 certs though I am not sure how exactly it would work.
If you use Kerberos and/or IPA for your Lunix/UNIX environment you can provision a user keytab to the machine from which you ssh and script around ssh call to do kinit with the user key in the keytab. Then you will not be asked for anything. kinit will acquire the ticket using the principal you scripted. It would use the key that you provisioned. And the SSH would use GSSAPI to log you into the box.
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Thanks Dmitri,
I'm sshing from linux boxes.
SSH does not support cert authentication but in RHEL there have been some patches to support X509 certs though I am not sure how exactly it would work.
I had this input also from someone else : if I find something interesting I will report about it here.
My point is that there may have been some kind of mecanism for the server on which to log in to ask for the client to bind the ldap server ( when pam knows that ldap is to be used ) rather than presenting the usual "login/passwd" message.
This binding operation may have involved sssd transactions between the client and the server ( so that sssd could bind directly the ldap server using information passed by the client, and being therefore able to certify about the requester identity ).
May be a wrong idea.
If you use Kerberos and/or IPA for your Lunix/UNIX environment you can provision a user keytab
At this stage my goal is to properly deploy a rightly operated ldap service for user authentication and authorization.
sso with kerberos or IPA are things that I consider but... as a next step really ( and with no targetted deadline ! :-)
Thanks for your attention any way,
--- Olivier
2012/3/28 Dmitri Pal dpal@redhat.com
**
I was now wondering if there would have any way to annonce my certificate using the "external SASL_MECH" mechanism over a login process to a linux box (let say using ssh), so that pam would not ask me to type a "login" and a "password" to log in ?
Don't hesitate to fire if my question is stupid.
Thanks,
Olivier
$ ldapsearch -ZZ uid=olivier
Are you sshing from Windows or Linux? I am not sure how you can do it with just a key or a cert. SSH does not support cert authentication but in RHEL there have been some patches to support X509 certs though I am not sure how exactly it would work.
If you use Kerberos and/or IPA for your Lunix/UNIX environment you can provision a user keytab to the machine from which you ssh and script around ssh call to do kinit with the user key in the keytab. Then you will not be asked for anything. kinit will acquire the ticket using the principal you scripted. It would use the key that you provisioned. And the SSH would use GSSAPI to log you into the box.
sssd-devel mailing listsssd-devel@lists.fedorahosted.orghttps://fedorahosted.org/mailman/listinfo/sssd-devel
-- Thank you, Dmitri Pal
Sr. Engineering Manager IPA project, Red Hat Inc.
Looking to carve out IT costs?www.redhat.com/carveoutcosts/
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Thanks Dmitri,
I'm sshing from linux boxes.
SSH does not support cert authentication but in RHEL there have been some patches to support X509 certs though I am not sure how exactly it would work.
I had this input also from someone else : if I find something interesting I will report about it here.
My point is that there may have been some kind of mecanism for the server on which to log in to ask for the client to bind the ldap server ( when pam knows that ldap is to be used ) rather than presenting the usual "login/passwd" message.
This binding operation may have involved sssd transactions between the client and the server ( so that sssd could bind directly the ldap server using information passed by the client, and being therefore able to certify about the requester identity ).
May be a wrong idea.
I'm afraid this is outside of scope of SSSD. Even when using Kerberos auth, I believe that SSH does the authentication by itself and contacts SSSD only for identification and subsequent authorization. X.509 authentication would be probably the same.
If you use Kerberos and/or IPA for your Lunix/UNIX environment you can provision a user keytab
At this stage my goal is to properly deploy a rightly operated ldap service for user authentication and authorization.
sso with kerberos or IPA are things that I consider but... as a next step really ( and with no targetted deadline ! :-)
I think that your life might be easier is you deployed IPA right away. After all, that's what IPA is for :-) Also SSH with IPA (Kerberos) might be the right solution you are looking for.
Thanks Jan
sssd-devel@lists.fedorahosted.org