2

I think I have some understanding problems with what I want to achieve...

So, let's start with what's currently working (all described servers are running CentOS 7) :

  • an OpenLDAP server which contains users' public keys
  • a "data" server running an OpenSSH daemon which permit users to connect thanks to their private key (with ssh command)

And now, my final goal :

  • a gitolite service (on the "data" server) which take users' public keys from the OpenLDAP server

I found this in the gitolite's changelog :

(a couple of contrib scripts - querying IPA based LDAP servers for group membership, and user key management)

So I thought it could be possible to achieve what I want but I don't know how...

I've read it's also possible to query an LDAP server to get groups informations. So I want to believe it's possible to do the same things with public keys.

I travel through a lot of links but I cannot find something that solve my issue... If someone have, even a little hint, to give to me, it would be great :)

Have a nice day !

PS : just wanted to add that I'm not afraid to read/write a lot of code. And it's not a problem if you're solution is to use something else than gitolite, even if keeping gitolite would be better for personal purpose.

EDIT1 :

So this is how things currently work :

When I'm trying to clone the default testing.git repository with this command :

git clone ssh://git@dataserver/testing.git

With the following ~/.ssh/config :

host dataserver
    hostname dataserver
    Identityfile ~/.ssh/user
    User git

My terminal is telling me this :

Cloning in 'testing'...
Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists

But if I had a public key for my user (user.pub) in the keydir folder, everything is fine :

git clone ssh://git@dataserver/testing.git
Cloning in 'testing'...
Enter passphrase for key '/home/user/.ssh/user_rsa:
warning: it seems that you've cloned a bare repository.
Verifying connectivity... done.

And the git repository is here :

ls -l | grep testing
drwxrwxr-x 3 user user 4096 mars 23 11:03 testing

EDIT 2 :

I'm just adding how my dataserver query OpenLDAP to get users' public key (just in case).

/etc/ssh/sshd_config :

AuthorizedKeysCommand /usr/bin/ssh-keyldaps %u
AuthorizedKeysCommandUser nobody

/usr/bin/ssh-keyldaps :

ldapsearch       -H ldaps://ldapserver \
                 -b dc=my,dc=domain \
                 -x -LLL \
                 -o ldif-wrap=no \
                 "(&(uid=$uid)(sshPublicKey=*))" 'sshPublicKey' |
                 sed -n 's/^sshPublicKey:\s*\(.*\)$/\1/p'

I excluded some lines since they're here just for logging purpose.

And thanks to this config, all users registred in LDAP with a sshPublicKey can log into dataserver thanks to their private key.

zrtYouyou
  • 21
  • 3
  • Do you mean, as in https://stackoverflow.com/a/22690631/6309? Or https://stackoverflow.com/a/17985744/6309? – VonC Mar 22 '18 at 13:10
  • Your first links is close to what I want. Instead of getting group informations from LDAP, I want to get the connecting user's public keys. Your second link use HTTP method, which does not fit my needs since I want to use SSH methods. – zrtYouyou Mar 22 '18 at 13:47
  • Once you have the login cnofirmed from ldap, the public key should be registered/accessible in the `gitolite-admin/keys` folder, no? – VonC Mar 22 '18 at 13:50
  • I'm editing my question to provide more details about the current behavior – zrtYouyou Mar 23 '18 at 09:45

1 Answers1

-1

AuthorizedKeysCommand for the sshd_config is probably what you want to have a look at. The documentation snippet reads like gitolite doesn't ship with anything for that, but rather relies on external factors.

You can set up sssd to authenticate against the LDAP server and then use sss_authorized_keys, for example.

Documentation should be easily findable.

towo
  • 1,887
  • 14
  • 12
  • On my data server, the `sshd_config` already calls a script to query user's public key from LDAP. Thanks to that, people can connect to data server through ssh by using their private key. – zrtYouyou Mar 22 '18 at 12:42