Environment : Ubuntu 14.04 & 16.04 Servers, Active Directory on Windows Server 2016, Ubuntu 14.04 & 16.04 clients. Ubuntu servers and clients are not on the domain.

Hello everyone,

I'm a little lost with all ways to achieve ldap authentication for ssh. But I can't find a suitable one for me.

My wish : I wan't to connect to my servers by login in with "sAMAccount@serverIP", my SSH keys are stored in my AD (new field added as odiSSHPubKeys). My server well communicate with my AD (ldapsearch query). I achieved that by updating my sshdconfig :


AuthorizedKeysCommand /usr/bin/auth
AuthorizedKeysCommandUser root



server=ldap.myad.net #Put your server IP
basedn=dc=mydomain,dc=net #Put your basedn

ldapsearch -LLL -o ldif-wrap=no -x -h $server -p $port -b $basedn -D $bindUser -w $bindPass -s sub "(sAMAccountName=$cn)" | sed -n 's/^[ \t]*odiSSHPubKeys:[ \t]*\(.*\)/\1/p'

When I connect to mathieu@, I'm kicked by preauth


Apr 18 11:56:26 MLL-HV-UBU-16 sshd[9103]: Invalid user mathieu from
Apr 18 11:56:26 MLL-HV-UBU-16 sshd[9103]: input_userauth_request: invalid user mathieu [preauth]
Apr 18 11:56:26 MLL-HV-UBU-16 sshd[9103]: Connection closed by port 50152 [preauth]

So my problem is that "mathieu" doesn't exist as user on my Ubuntu server. I try to force my cn in my /usr/bin/auth and log with root account (root@ and it works, so my /usr/bin/auth id good.

How can I disable preauth check to let ldap works ?

PS : I don't want a login/password authentication (for this solution, there is a lot of tutos, but not many for ssh keys or old ones).

Thanks for your help

  • Not even a clue ? I'll have to do login/password authentication and add my servers in domain in that case :(
    – matll42
    May 16 '17 at 9:24
  • Suggest using for TLS based ldap port for this. iirc 389 ain't. Aug 19 '17 at 13:56
  • @FlorianHeigl 389 is, if you use STARTTLS. Jan 10 '18 at 16:54
  • @matll42 You could also just use GSSAPI auth. It uses Kerberos to do passwordless auth and it "just works". Jan 10 '18 at 16:56

Best option here is to use sssd for this purpose. I use the AltSecurityIdentities to store the keys and join the servers to the domain using realmd.

Once domain joined, add the following to the /etc/sssd/sssd.conf file under the [domain/] section:

ldap_user_extra_attrs = altSecurityIdentities:altSecurityIdentities

ldap_user_ssh_public_key = altSecurityIdentities

ldap_use_tokengroups = True

and under the [sssd] section add:

services = nss, pam, sudo, ssh

Then to the /etc/ssh/sshd_config add:

AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys

AuthorizedKeysCommandUser root

Restart both services, and you should be able to login using your AD username and the password stored in the AltSecurityIdentities extended attribute in AD.


Recently, I worked on a Go tool that syncs SSH keys to your servers, based on Github/Gitlab groups memberships.

Check it out ! ==> http://github.com/samber/sync-ssh-keys

This avoids some hacks with LDAP :-(

  • As I also use Gitlab and all my SSH users are Gitlab users, I'll take a look at this alternative. Thanks
    – matll42
    Mar 31 '20 at 21:59
  • Kudos for ingenuity, but this actually is the hackish way of doing things. Modifying LDAP appropriately is the way to go ...
    – tink
    Nov 12 '20 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.