Hacker News Reader

Anybody here have experience with storing SSH public keys in LDAP or an alternative to syncing them across a range of servers?

I've had LDAP authentication to servers but it's always been with passwords.

View on HN

I just recently had to solve this problem. I ended up using this Python package: https://github.com/jirutka/ssh-ldap-pubkey

Ah very nice! This is exactly what I'm looking for. Couple questions.

Does this support multiple sshPublicKey attributes or just one per user?

Any performance issues with constantly hitting LDAP?

Multiple keys seem to be fine.

I haven't seen performance issues, but it's a relatively small deployment in the scheme of things. There are also existing solutions for caching here. NSCD seems to be the go-to for caching LDAP query results directly. Alternately, you could cache credentials at the PAM level with pam-ccreds (Debian package name).

I've done this, and it works well.

I used NSS-PAM-LDAPD [1], and openssh-ldap-publickey [2] with OpenLDAP

If you want more info about the setup ping me (email in my profile).

1: https://arthurdejong.org/nss-pam-ldapd/ 2: https://github.com/AndriiGrytsenko/openssh-ldap-publickey

Reply on news.ycombinator.com