The SSH service module will extract SSH keys from LDAP, optionally
create a home directory if it does not already exist, apply any key
command limitations specified by the administrator, and atomically
overwrite the user's authorized_keys
file.
To store the SSH keys in LDAP, we created an sshAccount schema
in our Three Rings Enterprise OID space. The schema is included with
the Splat distribution as schema/ooossh.schema
.
It depends on another included schema: schema/ooo.schema
. The SSH schema defines a new auxiliary object class,
sshAccount and an optional attribute,
sshPublicKey. Feel free to use this schema with
your own installation.
attributetype ( oooSSHAttributes:1 NAME 'sshPublicKey' DESC 'OpenSSH Public Key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 ) objectclass ( oooSSHClasses:1 NAME 'sshAccount' DESC 'OpenSSH Account' SUP top AUXILIARY MAY ( sshPublicKey ) )
The SSH service module supports
authorized_keys
command limitations and sanity
checking on the uid, gid, and home directory.
Create home directories for users. Set
to true
to enable home
directory creation, but be aware that other plugins (such as
the homeDirectory
plugin) may
also be configured to create the same home directory, with
different options.
Only write keys to subdirectories of the specified directory.
Do not write keys for uids lower than minuid.
Do not write keys for gids lower than mingid.
Limit user to the specified command.