3 ms·
FreeIPA has provided this for a while: https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/user-keys.html https://docs.fedoraproject.org/en-US/Fe
by subway 12y ago
FreeIPA has provided this for a while:
https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_Guide/user-keys.html https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_...
More recently the AuthorizedKeysCommand patch has made it's way into Ubuntu's sshd, similarly allowing sshd to call script that looks up a user's authorized keys from LDAP.
- jpgvm 12y agoMore correctly AuthorizedKeysCommand is in mainline OpenSSH, thus every recent release of all major distros have it.
- STRML 12y agoThis is a great perl script that makes for an easy AuthorizedKeysCommand [1]. SSH with LDAP is definitely an easier way to distribute keys and manage permissions than logging into each box. It's also a single point of failure in a way, but you can at least keep it completely inside a private network, and LDAP is well-known and easy to secure. 1. https://github.com/AndriiGrytsenko/openssh-ldap-publickey https://github.com/AndriiGrytsenko/openssh-ldap-publickey
- kgilpin 12y agoThe IPA in FreeIPA stands for "Identity, Policy, and Audit". Yet on the Roadmap page (http://www.freeipa.org/page/Roadmap http://www.freeipa.org/page/Roadmap), enjoy this statement: "The audit component of the project will remain deferred until further notice. You can see the reasoning in the About page." Therefore, for enterprise purposes, I can't see why anyone would take FreeIPA seriously.