I have mounted an LDAP server, I generate certificates for my users and I wanted to store certificates in ldap (certificates itself, not their directories), I found the following scheme used to store the public key, so I added the scheme and corresponding public keys of the users to the LDAP server.

# octetString SYNTAX
attributetype ( NAME 'sshPublicKey'
DESC 'MANDATORY: OpenSSH Public key'
EQUALITY octetStringMatch

# printableString SYNTAX yes|no
objectclass ( NAME 'ldapPublicKey' SUP top AUXILIARY
DESC 'MANDATORY: OpenSSH LPK objectclass'
MAY ( sshPublicKey $ uid )

I research to use ssh connecting to the server using public and private keys, and I found that for ssh read the public key of the LDAP server to need a AuthorizedKeysCommand command and a script that will take charge of seeking public key and give it to LDAP, found this script to seek public key ldap

server=servus2.inf #Put your server IP
basedn=ou=usuarios,dc=servus2,dc=inf #Put your basedn
ldapsearch -x -h $server -p $port -b $basedn -s sub"(objectclass=posixAccount)(uid=$cn)" | sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'

I put it in the folder /etc/ssh and gave execute permission to all users, also gave the permissions manager writing and reading, once done I added in the file /etc/ssh/sshd_config line:

AuthorizedKeysCommand /etc/ssh/script.sh

and I realized that the line was PubkeyAuthentication yes so once configured I restart the ssh server. From a client attempts to connect to the server via ssh as follows:

ssh -i claveprivada usuario@servus2.inf

but nothing makes me follow me I asking password, added the -vvv option to see detail that was going on, but does not tell me anything specific. I think is not reading line AuthorizedKeysCommand that does not come out at any time. I have looked at the log and I get no error with respect to that line or script so I think that is ignoring the line.

I searched for information about it and saw that earlier versions had a bug. I don't know if it has already been solved, but I upgraded to the version in Ubuntu 16, OpenSSH 7.1p2 but it did me no good as usual.

Does anyone know how to solve this problem?


I have tried to get the Public key of a certain user who is trying to login using ssh. ( whose Public key is stored in the LDAP server). Below configurations worked for me.

In /etc/ssh/sshd_config

AuthorizedKeysCommand /usr/bin/auth
AuthorizedKeysCommandUser nobody

and the script which takes user id(name) as the input is below.

server= #Put your server IP
basedn=ou=users,dc=myorg,dc=org #Put your basedn

ldapsearch -x -h $server -p $port -o ldif-wrap=no  -b $basedn -s sub "(&(objectClass=posixAccount)(uid=$cn))" | sed -n 's/^[ \t]*sshPublicKey:[ \t]*\(.*\)/\1/p'

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.