Hello there<br><br>Not sure that this is feasable nor that this is the right place<br>to submit this question but I think it is.<br><br>I use sssd to deal with authentication on my linux boxes :<br>OK<br><br>I also know how to use external SASL_MECH to bind my<br>
ldap server : I have produced and install a certificate with<br>an appropriate subject and signed it by a CA that is known<br>by my ldap server. Like this, I can bind the server over TLS<br>with my identity and without providing any passwd.<br>
<br>$ ldapsearch -ZZ uid=olivier<br>SASL/EXTERNAL authentication started<br>SASL username: 0.9.2342.19200300.100.1.1=guillard,ou=staff,dc=example,dc=fr<br>SASL SSF: 0<br>...response...<br><br>Right : nothing new.<br><br>
I was now wondering if there would have any way to annonce<br>
my certificate using the "external SASL_MECH" mechanism<br>over a login process to a linux box (let say using ssh), so that<br>pam would not ask me to type a "login" and a "password" to<br>
log in ?<br>
<br>Don't hesitate to fire if my question is stupid.<br><br>Thanks,<br><br>---<br>Olivier<br><br><br>PS, to rephrase that : I'm looking for a way to use a personnal key<br>
to login without having to provide a password. ssh keys are not<br>
the right solution because I would need to install the public key<br>
in every authorized_key on my network ( I would like a centralized<br>
solution ).<br><br>I also found this :<br><a href="http://code.google.com/p/openssh-lpk/">http://code.google.com/p/openssh-lpk/</a><br><br>But I don't want to patch ssh if possible since I highly prefere to<br>use standard tools provided as much as possible<br>
<br>I'm on RedHat6<br><br><br><br>