1

We have a client intranet with client user credentials stored in a mysql database.

We are now trying to enabled SSH access to one of our servers for each client - where the authentication would come from our existing database.

Any help would be awesome.

2 Answers 2

3

It sure looks like OS X uses PAM. In that case you should be abe to use the PAM-MySQL to perform any type of auth you want. Out of the box OS X uses a pretty straightforward PAM config for sshd:

$ cat /etc/pam.d/sshd
# sshd: auth account password session
auth       required       pam_nologin.so
auth       optional       pam_afpmount.so
auth       sufficient     pam_securityserver.so
auth       sufficient     pam_unix.so
auth       required       pam_deny.so
account    required       pam_securityserver.so
password   required       pam_deny.so
session    required       pam_launchd.so
session    optional       pam_afpmount.so

I haven't set up PAM-MySQL before, but assuming it's similar to other external database PAM modules, there will be a config file that you use to select the db credentials, which tables should be used, etc. Then you would insert auth sufficient pam_mysql.so just before the pam_unix.so line in /etc/pam.d/sshd.

Theoretically that should be all you need.

3
  • I've confirmed that the pam_mysql project I linked to above will build just fine as long as you have the MySQL libraries installed. And it looks like instead of a config file the various options are passed as arguments in the "pam.d/sshd" file. I can't test any further without actually building up a dummy database, but it sure looks promising.
    – Insyte
    Aug 3, 2009 at 22:15
  • Hi - Thanks for the reply but forgive me I'm a bit of a n00b. The PAM-MySQL website isn't the best documented I've ever seen, do you have an example PAM config file (the one with the selection of authentication credentials)?
    – Danny
    Aug 3, 2009 at 22:34
  • Take a look a the README file included in pam-mysql. I was incorrect about the settings being stored in a config file; they're appended to the pam file like so: "auth sufficient pam_mysql.so user=dbuser passwd=dbpasswd table=users usercolumn=myusers passwdcolumn=mypasswds". There are several other options that can be used as well, all well described in the README file.
    – Insyte
    Aug 4, 2009 at 15:12
0

There are probably a couple ways you could do this:

  1. Set up an Open Directory master, bind your server to it (or maybe that server would be the OD Master), and write some hooks for your client intranet that add/remote/update users in OD whenever there is a change
  2. Write a Directory Services plug-in that is installed on your server which would talk to your MySQL database

For the 1st option, see Apple's Mac OS X Server documentation, esp. those relating to Open Directory. There is a dscl command which can be run from scripts to add/remove/update entries in Open Directory.

For the Directory Services option, see Apple's Directory Services documentation, esp. the Writing Open Directory Plug-ins document.

There are probably other ways, but these are the two that jumped to mind.

1
  • Upvoted the PAM answer as that should be exponentially easier to implement than either of my suggestions.
    – morgant
    Aug 3, 2009 at 22:06

You must log in to answer this question.