[SSSD-users] sss_ssh_authorizedkeys returns "Error looking up public keys"
Pavel Březina
pbrezina at redhat.com
Wed Mar 20 09:19:11 UTC 2013
On 03/19/2013 08:05 PM, Mathieu Lemoine wrote:
> 2013/3/19 Jakub Hrozek <jhrozek at redhat.com <mailto:jhrozek at redhat.com>>
>
> On Tue, Mar 19, 2013 at 07:15:21PM +0100, Jakub Hrozek wrote:
> > On Tue, Mar 19, 2013 at 01:56:20PM -0400, Mathieu Lemoine wrote:
> > > Hello,
> > >
> > > I have sssd 1.9.4 (from
> > > https://launchpad.net/~nicholas-hatch/+archive/auth/+packages)
> configured
> > > on an OpenLDAP server.
> > > getent passwd, getent group, authentication and cache is
> working great.
> > >
> > > My issue now lies with the SSH public key.
> > >
> > > My user has the ldapPublicKey objectClass, and the key is in the
> > > sshPublicKey attribute.
> > >
> > > sss_ssh_authorizedkeys is still returning "Error looking up
> public keys".
> > > An inquiry on the #sssd chan directed me to this mailing-list
> and more
> > > precisely to jcholast, I tried to check out the commits, but
> nothing seems
> > > to get out of it...
> >
> > Full disclosure: I was the one who redirected Mathieu to you,
> Honza :-)
> >
> > >
> > > If any of you had informations regarding that, it'd be greatly
> appreciated.,
> > > Mathieu.
> >
> > I think as a first step, it would be nice to put debug_level=8
> into the
> > [ssh] section of the sssd.conf file, restart the SSSD and then attach
> > the ssh responder logs (/var/log/sssd/sssd_nss.log).
>
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> Sorry, this is a copy-n-paste error. The *ssh* responder log is located
> at:
> /var/log/sssd/sssd_ssh.log
>
> The path I copied was the *nss* responder log. Sorry again.
>
> Ok, so first point, I didn't know I needed a sss responder for ssh (not
> mentionned anywhere as far as I know). Thanks for this.
> I added ", ssh" to the "services" line and restarted sssd.
>
> sss_ssh.log stays hopelessly empty even with debug_level 10 and I still
> have the sshPublicKey is not available in sss_office.log
>
> However sss_ssh_authorizedkeys now doesn't return any error, just a big
> nothing...
>
> Attached is the ldif of my user (I removed any sensitive information,
> anyway, the entry has been fetched using anonymous access, so passwords
> and such has been left aside.
> id_provider = ldap
> auth_provider = ldap
> chpass_provider = ldap
Hi,
I'm afraid we support ssh keys only with IPA backend at the moment.
More information about the sssd-users
mailing list