I have mounted an LDAP server, I generate certificates for my users and I wanted to store certificates in ldap (certificates itself, not their directories), I found the following scheme used to store the public key, so I added the scheme and corresponding public keys of the users to the LDAP server.

# octetString SYNTAX
attributetype ( NAME 'sshPublicKey'
DESC 'MANDATORY: OpenSSH Public key'
EQUALITY octetStringMatch

# printableString SYNTAX yes|no
objectclass ( NAME 'ldapPublicKey' SUP top AUXILIARY
DESC 'MANDATORY: OpenSSH LPK objectclass'
MAY ( sshPublicKey $ uid )

I research to use ssh connecting to the server using public and private keys, and I found that for ssh read the public key of the LDAP server to need a AuthorizedKeysCommand command and a script that will take charge of seeking public key and give it to LDAP, found this script to seek public key ldap

server=servus2.inf #Put your server IP
basedn=ou=usuarios,dc=servus2,dc=inf #Put your basedn
ldapsearch -x -h $server -p $port -b $basedn -s sub"(objectclass=posixAccount)(uid=$cn)" | sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'

I put it in the folder /etc/ssh and gave execute permission to all users, also gave the permissions manager writing and reading, once done I added in the file /etc/ssh/sshd_config line:

AuthorizedKeysCommand /etc/ssh/script.sh

and I realized that the line was PubkeyAuthentication yes so once configured I restart the ssh server. From a client attempts to connect to the server via ssh as follows:

ssh -i claveprivada [email protected]

but nothing makes me follow me I asking password, added the -vvv option to see detail that was going on, but does not tell me anything specific. I think is not reading line AuthorizedKeysCommand that does not come out at any time. I have looked at the log and I get no error with respect to that line or script so I think that is ignoring the line.

I searched for information about it and saw that earlier versions had a bug. I don't know if it has already been solved, but I upgraded to the version in Ubuntu 16, OpenSSH 7.1p2 but it did me no good as usual.

Does anyone know how to solve this problem?

1 Answer 1


I have tried to get the Public key of a certain user who is trying to login using ssh. ( whose Public key is stored in the LDAP server). Below configurations worked for me.

In /etc/ssh/sshd_config

AuthorizedKeysCommand /usr/bin/auth
AuthorizedKeysCommandUser nobody

and the script which takes user id(name) as the input is below.

server= #Put your server IP
basedn=ou=users,dc=myorg,dc=org #Put your basedn

ldapsearch -x -h $server -p $port -o ldif-wrap=no  -b $basedn -s sub "(&(objectClass=posixAccount)(uid=$cn))" | sed -n 's/^[ \t]*sshPublicKey:[ \t]*\(.*\)/\1/p'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .