HOWTO : Configure OpenSSH to Fetch Public Keys from OpenLDAP for Authentication on CentOS

Today we will configure our OpenLDAP server to store SSH public keys so that the OpenSSH daemon can fetch them and thus authenticate our users.

To do this, we first need two CentOS machines. This is easy to achieve via a KickStart. If you need help building a KickStart server, follow my previous blog post. Then we need a working OpenLDAP server. If you don't have one, then follow my previous blog posts to set one up.

Once this is done, connect to a machine that is set to become the OpenSSH client of the OpenLDAP server.

ssh client.example.org

Install the required packages. Most likely you will already have both openssh and openssh-server, but not openssh-ldap.

sudo yum -y install openssh openssh-server openssh-ldap nss-pam-ldapd

This will provide you with the required OpenLDAP schema and special sshd_config(5) configuration to enable the OpenSSH daemon to fetch SSH public keys from the OpenLDAP server.

If we take a look at what the openssh-ldap package provides, we'll find a nice HOWTO file.

rpm -ql openssh-ldap

/usr/libexec/openssh/ssh-ldap-helper

/usr/libexec/openssh/ssh-ldap-wrapper

/usr/share/doc/openssh-ldap-5.3p1

/usr/share/doc/openssh-ldap-5.3p1/HOWTO.ldap-keys

/usr/share/doc/openssh-ldap-5.3p1/ldap.conf

/usr/share/doc/openssh-ldap-5.3p1/openssh-lpk-openldap.schema

/usr/share/doc/openssh-ldap-5.3p1/openssh-lpk-sun.schema

/usr/share/man/man5/ssh-ldap.conf.5.gz

/usr/share/man/man8/ssh-ldap-helper.8.gz

This HOWTO file is basically what we're doing here. Take a look and see for yourself.

OpenLDAP Server Configuration

Next we need to configure OpenLDAP. To do so, we first create a temporary configuration file which includes only two schemas : the core and then the openssh-openldap one.

echo "include /etc/openldap/schema/core.schema" > ~/ldap/openssh-ldap.conf
rpm -ql openssh-ldap | grep -i schema | grep -i openldap | sed 's/^/include /g' >> ~/ldap/openssh-ldap.conf

The resulting file is very small :

cat ~/ldap/openssh-ldap.conf

Let's make sure we don't have old artifacts lying around.

rm -rf ~/ldap/cn\=config*

We then create the cn=config version of this file. This creates the ~/ldap/cn\=config directory.

slapcat -f ~/ldap/openssh-ldap.conf -F ~/ldap -n 0

We then need to clean up the resulting files before we can add them to our OpenLDAP server.

sed -re "/^(structuralObjectClass|entry[C|U]|creat[e|o]|modif[i|y])/d" cn\=config/cn\=schema/cn\=\{1\}openssh-lpk-openldap.ldif > ~/ldap/openssh-ldap.ldif

sed -i.bak -e "s/{1}openssh-lpk-openldap/openssh-openldap/g" ~/ldap/openssh-ldap.ldif

sed -i.bak -e "s/cn=openssh-openldap/cn=openssh-openldap,cn=schema,cn=config/g" ~/ldap/openssh-ldap.ldif

Which results in a very small file :

cat ~/ldap/openssh-ldap.ldif

We can now add this to our OpenLDAP server.

ldapmodify -axZWD cn=admin,dc=example,dc=org -f ~/ldap/openssh-ldap.ldif

And we can make sure it's indeed in our DIT.

ldapsearch -xLLLZWD cn=admin,dcexample,dc=org -b cn=config

VERY IMPORTANT : If you have a replicated OpenLDAP setup, then MAKE SURE YOU ALSO ADD THE NEW openssh-ldap.ldif FILE TO THE REPLICATED MACHINES! If you don't do so, the replicated servers (or consumers in OpenLDAP language) will protest and fail to operate. You have been warned!

At this point we need to modify our OpenLDAP users to use the new attributes we just installed (i.e. sshPublicKey and ldapPublicKey). This task is quite easier with an LDAP Browser. I really like Apache Directory Studio. In any case, use your favorite LDAP editor and connect to the OpenLDAP server.

So for our users, we add the new objectClass attribute named ldapPublicKey. Once this new objectClass is installed, we can then add the new sshPublicKey attribute.

Of course, we need to add a value to the sshPublicKey. But what? Easy, just add your existing SSH Public Key usually stored in the users's ~/.ssh/id_rsa.pub file. If you don't already have one, simply generate it with this command :

ssh-keygen -t rsa -b 2048

This command generates an RSA key pair. This key pair is stored in two files. One holds the private key (~/.ssh/id_rsa) while the other stores the public one (~/.ssh/id_rsa.pub). Keep the private one safe!

Now that we have configured our user, let's see how this user is seen in our OpenLDAP server? I've listed the relevant attributes in bold in the following output. I've also changed both the userPassword and sshPublicKey attributes for obvious reasons ;)

ldapsearch -xZWLLLD cn=admin,dc=example,dc=org -b ou=users,dc=example,dc=org cn=davidr
Enter LDAP Password:

dn: cn=davidr,ou=users,dc=example,dc=org
uid: davidr
gecos: David Robillard
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
objectClass: ldapPublicKey
userPassword:: e1NTSEF9UnNBTXFPSTM2NDdxZzFnQVpasdasdAwc0VWZmE=
shadowLastChange: 15140
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 2000
gidNumber: 2000
homeDirectory: /nfs/home/davidr
cn: davidr
sshPublicKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQAhygfeeDQOSbGhDjPqQSQz1BE9ogqvWHNpKfG3Hhp0uTXzzMyTmVqGDAMDl3Nc3rXjg1rf1Vcmi9+FUmh5nni7JUCvrhZoHdJuuVY3OlnXWRUREKIFrPKQ1YIl0q81iomLwJwnhwWYzfQbQyUtKprdg6pobUVSf+76D1Svjqv9PbimAD6nw== davidr@bwmdavidr

Configure OpenSSH

Now that OpenLDAP is ready, we must configure OpenSSH to fetch the keys from OpenLDAP. We do so by installing new configuration lines in sshd_config(5). These lines are :

AuthorizedKeysCommand /usr/libexec/openssh/ssh-ldap-wrapper

AuthorizedKeysCommandRunAs nobody

PubkeyAuthentication yes

So do it.

sudo vim /etc/ssh/sshd_config

And we make sure to restart the OpenSSH daemon so that it knows about this new configuration.

sudo /etc/init.d/sshd restart

Then we must configure the ldap.conf(5) specifically for OpenSSH. So we place the file under /etc/ssh.

sudo vim /etc/ssh/ldap.conf

We can now try the new setup. From another machine, try to connect to the server we just configured to fetch the SSH key from our OpenLDAP server.

ssh -v client.example.org

And in our /var/log/secure file, we should see these lines :

Nov  4 13:30:42 client sshd[4924]: Accepted publickey for davidr from 192.168.20.216 port 32135 ssh2

Nov  4 13:30:42 client sshd[4924]: pam_unix(sshd:session): session opened for user davidr by (uid=0)

And there you go :)

HTH,

DA+