I have mounted an LDAP server, I generate certificates for my users and I wanted to store certificates in ldap (certificates itself, not their directories), I found the following scheme used to store the public key, so I added the scheme and corresponding public keys of the users to the LDAP server.
# octetString SYNTAX
attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey'
DESC 'MANDATORY: OpenSSH Public key'
EQUALITY octetStringMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
# printableString SYNTAX yes|no
objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
DESC 'MANDATORY: OpenSSH LPK objectclass'
MAY ( sshPublicKey $ uid )
)
I research to use ssh connecting to the server using public and private keys, and I found that for ssh read the public key of the LDAP server to need a AuthorizedKeysCommand command and a script that will take charge of seeking public key and give it to LDAP, found this script to seek public key ldap
#!/bin/bash
cn=$usuario
server=servus2.inf #Put your server IP
basedn=ou=usuarios,dc=servus2,dc=inf #Put your basedn
port=389
ldapsearch -x -h $server -p $port -b $basedn -s sub"(objectclass=posixAccount)(uid=$cn)" | sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'
I put it in the folder /etc/ssh
and gave execute permission to all users, also gave the permissions manager writing and reading, once done I added in the file /etc/ssh/sshd_config
line:
AuthorizedKeysCommand /etc/ssh/script.sh
and I realized that the line was PubkeyAuthentication yes
so once configured I restart the ssh server. From a client attempts to connect to the server via ssh as follows:
ssh -i claveprivada [email protected]
but nothing makes me follow me I asking password, added the -vvv
option to see detail that was going on, but does not tell me anything specific. I think is not reading line AuthorizedKeysCommand
that does not come out at any time. I have looked at the log and I get no error with respect to that line or script so I think that is ignoring the line.
I searched for information about it and saw that earlier versions had a bug. I don't know if it has already been solved, but I upgraded to the version in Ubuntu 16, OpenSSH 7.1p2 but it did me no good as usual.
Does anyone know how to solve this problem?