OpenSSH Public Keys

The SSH service module will extract SSH keys from LDAP, optionally create a home directory if it does not already exist, apply any key command limitations specified by the administrator, and atomically overwrite the user's authorized_keys file.

LDAP Schema

To store the SSH keys in LDAP, we created an sshAccount schema in our Three Rings Enterprise OID space. The schema is included with the Splat distribution as schema/ooossh.schema. It depends on another included schema: schema/ooo.schema . The SSH schema defines a new auxiliary object class, sshAccount and an optional attribute, sshPublicKey. Feel free to use this schema with your own installation.

attributetype ( oooSSHAttributes:1 NAME 'sshPublicKey'
        DESC 'OpenSSH Public Key'
        EQUALITY octetStringMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )

objectclass ( oooSSHClasses:1 NAME 'sshAccount'
        DESC 'OpenSSH Account'
        SUP top AUXILIARY
        MAY ( sshPublicKey ) )
        

SSH Service Options

The SSH service module supports authorized_keys command limitations and sanity checking on the uid, gid, and home directory.

SSH Service Options

makehome

Create home directories for users. Set to true to enable home directory creation, but be aware that other plugins (such as the homeDirectory plugin) may also be configured to create the same home directory, with different options.

home

Only write keys to subdirectories of the specified directory.

minuid

Do not write keys for uids lower than minuid.

mingid

Do not write keys for gids lower than mingid.

command

Limit user to the specified command.