Page cover

SSH key authentication for LDAP login

To be upfront about the concept of password login, I believe that it has been one of the worst invention in technology innovation, and we are sort of stuck here with it for long time. On the other hand, we have also been unleashing the power of ssh key authentication for login on most of the remote system access these days including Windows. That's why I have been always choosing key authentication over password for remote access login.

Due to the domination of Windows Active Directory for identity management in our industry, we are still heavily relaying on its password authentication even for Linux with LDAP integration. Sometimes it feels so bizarre to type in your LDAP username and password for Linux ssh remote session. Well, I am not a big fan of that at all. Fortunately I have found a way to use ssh key for LDAP login specifically for Linux. In this article, I will walk you through how it can be done with very simple few steps.

Prerequisites

  • Windows Server 2022 Active Directory

    • IP Address: 192.168.100.100/24

    • Domain Name: home.lab

    • Domain Admins privilege

  • RockyLinux 8 Linux as client for LDAP integration

    • IP Address: 192.168.100.205/24

    • Internet connectivity to download required software such as realmd, sssd, krb5-workstation, samba-common-tools and krb5-libs

    • Sudo privilege

Steps

Configuration on Windows Server 2022 Active Directory

  • Login to Windows AD server and run the following PowerShell commands

  • Create Windows AD group called "ssh".

  • Create Windows AD user called "user1" with its ssh public key added to the altSecurityIdentities attribute.

  • Add the user1 to the groups, ssh and Domain Admins to allow ssh login with sudo privilege.

  • That's it all on the Windows AD server side.

Configuration on RockyLinux 8

  • Install required software with DNF package manager

  • Configure DNS pointing to the Windows AD server in /etc/sysconfig/network-scripts/ifcfg-enp1s0

  • Restart Network Manager to apply the change.

  • Verify if the Windows AD domain is available.

  • Join the node to the Windows AD domain home.lab.

  • Update /etc/ssh/sshd_config to allow ssh key authentication for LDAP users.

  • Restart the sshd daemon to apply the change.

  • Configure /etc/sssd/sssd.conf for ssh authentication for LDAP attributes.

  • Restart sssd daemon to apply the change

  • It's also possible to grant sudo privilege without password prompt if a user is the members of both Domain Admins and ssh groups by adding following line to /etc/sudoers file.

  • Now verify the user1 ssh login and sudo privilege on RockyLinux 8 end.

  • That's all we have to configure on RockyLinux 8 end for ssh key authentication to work with LDAP login.

PreviousSSH certificate authenticationNextUsing GPG to encrypt/decrypt files or messages

Last updated

Was this helpful?