Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to set up ssh and Active Directory (Win2008r2 flavour) such that domain-users can access *nix and ssh-servers-running-on-Windows-servers without needing to type their password?

If so, how?

I've found some documentation that suggests that it (or something like it) is possible by modifying the AD schema to make room for a public-key.

However, most of the concepts themselves are new to me, because really, I'm a developer masquerading as a sysadmin in a dev-ops team.

Context: we have some Windows boxes, and some *nix boxes, and we want to run some remote-admin automation on both sets of them in a continuous-deployment type scenario as well as an ad-hoc maintenance-from-a-central-place type scenario.

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

I have attempted the exact same thing as you have, specifically attempting to manage Linux and Windows with the same toolset, and have found nothing but pain and frustration. The two are so very different in setup, outlook, and design assumptions that tools that work well on one (SSH, PowerShell) are ugly, fragile hacks on the other platform (yes, there exists a PowerShell for Linux, written in Mono). The fragility has pushed us to use two separate deployment systems for our Windows and Linux systems. I don't know of any existing tool that can do both, though I know of a couple who are adamantly trying (both Chef and Puppet is reported to be working on such a Grand Unified Management Framework, Chef has delivered).

My advise, especially since you seem to be a Linux-first organization, is see what kind of hooks you can find for accessing the Windows Remote Management framework ("winrm" is the keyword). It's kerberized SOAP calls over HTTP at the base, so is actually a lot easier on the remote system than installing SSH servers on your Windows machines. Ruby has a gem that'll do it. WinRM is interesting because it is Microsoft's designated "run commands on remote machines" framework, which is what you're attempting to use SSH for, and theoretically offers either cmd.exe or PowerShell as a command-interpreter.

share|improve this answer
    
Actually, we're a Windows-first organisation that is gradually learning that there's more to life than a faintly-blue-tinted GUI and RSI from clicking on things. We just also have a lot of legacy constraints (in more than the tech sense), and it was in fact easier to get going with deployment automation in ruby over ssh than it would have been with a pure MS toolset (essentially what we have is the result of a developer throwing his arms up in the air and saying to hell with the lack of progress with anything else). Thanks for the reply; hadn't realised chef had shipped... –  Peter Mounce Oct 24 '11 at 21:50
    
Chef shipped today, so I am not surprised you hadn't heard. My first version of this post didn't have it yet. –  sysadmin1138 Oct 25 '11 at 1:16
add comment

I have a setup that indirectly achieves the same purpose for some of my systems. SSH access to the target systems is via public/private key only. The keys are stored on a network share which is accessible only to those permitted to have access. Kind of simple and crude but quite effective. Of course there's nothing to prevent an authorised user from copying the key(s) but only trusted users have access anyway.

share|improve this answer
add comment

Another way of doing this is the way I am doing it which is with a combination of samba with winbind to add the system to aduc and use kerberos for single sign on.I have several guides if you are I interested.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.