store ssh public keys in LDAP/AD
reddit / freebsd

----------------------------------------------------------------------
Spparkee · 2023-01-20 18:25

Does anyone have a working setup for storing ssh public keys in
LDAP/AD and using sshd to look for them there rather than in a local
file?

----------------------------------------------------------------------
[deleted] · 2023-01-21 07:10

[deleted]

----------------------------------------------------------------------
mqudsi · 2023-01-21 15:16

Not any out-of-the-box method because OpenSSH authors are against the
infrastructural complexity of X.509 PKI.

You can readily convert an SSH public key into X.509 format and store
those in LDAP but that’s not how X.509 authentication is normally done
and there’s no SSH build that retrieves them from there that I know of
- though it’s easy enough to write a script to either wrap SSH and
sync known_hosts from LDAP for the named target or write a daemon or
cronjob to do the same.

The alternative is to use a fork of SSH with full PKI support, ditch
LDAP entirely, and use the typical CA, signed X.509 server certs, and
revocation stack that the web uses. That port of SSH [can be
downloaded here](https://roumenpetrov.info/secsh/) and, despite the
look of that webpage, is still patched and maintained.

----------------------------------------------------------------------
vermaden · 2023-01-21 15:18

You can use FreeIPA/IDM to store SSH keys there:

- https://freeipa.readthedocs.io/en/latest/workshop/10-ssh-key-
management.html

- https://www.freeipa.org/images/d/d2/Freeipa30_SSH_Public_Keys.pdf

This is how you connect FreeBSD to FreeIPA/IDM if needed:

- https://vermaden.wordpress.com/2022/11/17/connect-freebsd-freeipa-
idm/

If not FreeIPA/IDM then you can also try Keycloak:

- https://freshports.org/net/keycloak/

- https://www.keycloak.org/

Hope that helps.

----------------------------------------------------------------------
Spparkee · 2023-01-23 16:19

Since this affects hundreds of servers changing IDM isn't an option,
at least not for the short term.

Thank you for the information!

----------------------------------------------------------------------
Spparkee · 2023-02-07 14:26

An alternative is to use SSSD. SSSD can authenticate with public keys
when the keys are stored in AD. However the latest version is broken
due to ldb22.

There is a related post
[here](https://forums.freebsd.org/threads/cannot-open-usr-local-lib-
sssd-libsss_ad-so.87771/).