openldap sshkey ＆ 用戶自定義屬性

http://qiita.com/T_Tsan/items/eeb0a9ae9b4cdeb80934
https://www.ossramblings.com/using-ldap-to-store-ssh-public-keys-with-sssd

安裝

yum -y install openssh-ldap
cp /usr/share/doc/openssh-ldap-6.6.1p1/openssh-lpk-openldap.schema /etc/openldap/schema

服務器加入schema

# /etc/openldap/slapd.conf
include     /etc/openldap/schema/openssh-lpk-openldap.schema
include     /etc/openldap/schema/my.schema

重啓服務 配置生效

cd /etc/openldap/
rm -rf slapd.d/*
slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
chown -R ldap:ldap /etc/openldap/slapd.d
systemctl restart slapd

生成用戶key

ssh-keygen -b 2048 -t rsa -f /tmp/admin01.pem -q -N ''
ssh-keygen -b 2048 -t rsa -f /tmp/op01.pem -q -N ''
ssh-keygen -b 2048 -t rsa -f /tmp/dev01.pem -q -N ''

用戶信息導入

cat << _EOF_ | ldapmodify -x -W -H ldaps:/// -D cn=manager,dc=suntv,dc=tv
dn: uid=admin01,ou=people,dc=suntv,dc=tv
changetype: modify
add: objectClass
objectClass: ldapPublicKey
-
add: sshPublicKey
sshPublicKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtFaqzott45UAn3PwrmleujMJxZtugxH5Hq8UaD5OfhbOsMU1ATAQF48hCreQZXWYr3kqAD61yYzkXuoA57/3VkSGklEtOgTbweJvz2mtEMslFvQxnGqeijEvEdy4BWDZvWIq153/5Rf2hJCQYr8OVKSLfjWqbFxNycbvDfJgxOB8EUZEDIzBXrecYQgnJeYDeDAx0V8aLmb4cK99vsU9XTUAx+59bzuwm+ZqHmQqYIcLvtUm49HZ2eY+O4q6/Y+ov/KvyEW7PzeOaQqz3xTHkQH8TZZBZri/SDxxX5OCpqlz4vMNOqu8Azro4hYOyeILhAltbjDkpU3+kcvXbLoSN ken@ken-ThinkPad-X220
-
add: objectClass
objectClass: MyAccount
-
add: active
active: 1
-
add: access
access: ssh

dn: uid=op01,ou=people,dc=suntv,dc=tv
changetype: modify
add: objectClass
objectClass: ldapPublicKey
-
add: sshPublicKey
sshPublicKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFclesnE+mETaKgqvNcfGvK3u2+z8qgzUQgE9I2fgd7lh2sEIR4zxKiSlNW6LN386VWFZ0FkQol5/Y3ZpivPEsqUjOQ5x90bNgrlsqCenLRtsO+uN7oqfzjpTBunq7W9XQ+c4iiCBX6xoHTWjUbIlw9FWkC7dkpMXQHJmbAF57iDsBTMhXrjEzORGSTTBNIO5sz4QEqICxzG4n3YdGGMLUutVDXH1tJWytU1+VUcaSLUyMAGmDB1r+DhUi4vsTb0BZ8V3odSzvC0nuww47ooM0FGb8X1Av7DfcJ3VcEQl5ges+HRqwMxLzSV+GFBurnDXa1SixIWuObRNhaq8Swekr ken@ken-ThinkPad-X220
-
add: objectClass
objectClass: MyAccount
-
add: active
active: 1
-
add: access
access: ssh

dn: uid=dev01,ou=people,dc=suntv,dc=tv
changetype: modify
add: objectClass
objectClass: ldapPublicKey
-
add: sshPublicKey
sshPublicKey: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCtFaqzott45UAn3PwrmleujMJxZtugxH5Hq8UaD5OfhbOsMU1ATAQF48hCreQZXWYr3kqAD61yYzkXuoA57/3VkSGklEtOgTbweJvz2mtEMslFvQxnGqeijEvEdy4BWDZvWIq153/5Rf2hJCQYr8OVKSLfjWqbFxNycbvDfJgxOB8EUZEDIzBXrecYQgnJeYDeDAx0V8aLmb4cK99vsU9XTUAx+59bzuwm+ZqHmQqYIcLvtUm49HZ2eY+O4q6/Y+ov/KvyEW7PzeOaQqz3xTHkQH8TZZBZri/SDxxX5OCpqlz4vMNOqu8Azro4hYOyeILhAltbjDkpU3+kcvXbLoSN ken@ken-ThinkPad-X220
-
add: objectClass
objectClass: MyAccount
-
add: active
active: 1
-
add: access
access: ssh
_EOF_

目標服務器配置

ssh

# /etc/ssh/sssd_config
PubkeyAuthentication yes
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys # 獲取sssd中publickey
AuthorizedKeysCommandUser nobody # 7.x
# AuthorizedKeysCommandRunAs nobody # 6.x

sssd

cat > /etc/sssd/sssd.conf << _EOF_ 
[domain/LDAP]
debug_level = 9
cache_credentials = True
enumerate = false

id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
sudo_provider = ldap

ldap_uri = ldaps://master.local
ldap_backup_uri = ldaps://slave.local
ldap_search_base = dc=suntv,dc=tv
ldap_user_search_base = ou=people,dc=suntv,dc=tv
ldap_group_search_base = ou=group,dc=suntv,dc=tv
ldap_sudo_search_base = ou=sudoer,dc=suntv,dc=tv

access_provider = ldap
ldap_access_order = filter
ldap_access_filter = (&(&(active=1)(access=ssh))(|(memberOf=cn=admin,ou=host,dc=suntv,dc=tv)(memberOf=cn=dev,ou=host,dc=suntv,dc=tv))) # 用戶過濾條件
ldap_user_ssh_public_key = sshPublicKey # 支持ssh public key

ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/ca.crt
ldap_tls_reqcert = never
ldap_id_use_start_tls = false

[sssd]
domains = LDAP
services = nss, pam, sudo, ssh
config_file_version = 2

[nss]
domains = LDAP
filter_users = root
filter_groups = root

[pam]
domains = LDAP

[sudo]
domains = LDAP

[ssh]
domains = LDAP
ssh_hash_known_hosts = false
_EOF_

測試

ssh -i admin01.pem admin01@192.168.1.21
ssh -i op01.pem op01@192.168.1.21
ssh -i dev01.pem dev01@192.168.1.21

ssh -i admin01.pem admin01@192.168.1.22
ssh -i op01.pem op01@192.168.1.22
ssh -i dev01.pem dev01@192.168.1.22

還沒有解決問題

ssh支持password和sshkey兩種登陸方式，我須要只容許root或者指定用戶使用password方式登陸，其餘用戶只能用sshkey方式