Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a client intranet with client user credentials stored in a mysql database.

We are now trying to enabled SSH access to one of our servers for each client - where the authentication would come from our existing database.

Any help would be awesome.

share|improve this question

It sure looks like OS X uses PAM. In that case you should be abe to use the PAM-MySQL to perform any type of auth you want. Out of the box OS X uses a pretty straightforward PAM config for sshd:

$ cat /etc/pam.d/sshd
# sshd: auth account password session
auth       required
auth       optional
auth       sufficient
auth       sufficient
auth       required
account    required
password   required
session    required
session    optional

I haven't set up PAM-MySQL before, but assuming it's similar to other external database PAM modules, there will be a config file that you use to select the db credentials, which tables should be used, etc. Then you would insert auth sufficient just before the line in /etc/pam.d/sshd.

Theoretically that should be all you need.

share|improve this answer
I've confirmed that the pam_mysql project I linked to above will build just fine as long as you have the MySQL libraries installed. And it looks like instead of a config file the various options are passed as arguments in the "pam.d/sshd" file. I can't test any further without actually building up a dummy database, but it sure looks promising. – Insyte Aug 3 '09 at 22:15
Hi - Thanks for the reply but forgive me I'm a bit of a n00b. The PAM-MySQL website isn't the best documented I've ever seen, do you have an example PAM config file (the one with the selection of authentication credentials)? – Danny Aug 3 '09 at 22:34
Take a look a the README file included in pam-mysql. I was incorrect about the settings being stored in a config file; they're appended to the pam file like so: "auth sufficient user=dbuser passwd=dbpasswd table=users usercolumn=myusers passwdcolumn=mypasswds". There are several other options that can be used as well, all well described in the README file. – Insyte Aug 4 '09 at 15:12

There are probably a couple ways you could do this:

  1. Set up an Open Directory master, bind your server to it (or maybe that server would be the OD Master), and write some hooks for your client intranet that add/remote/update users in OD whenever there is a change
  2. Write a Directory Services plug-in that is installed on your server which would talk to your MySQL database

For the 1st option, see Apple's Mac OS X Server documentation, esp. those relating to Open Directory. There is a dscl command which can be run from scripts to add/remove/update entries in Open Directory.

For the Directory Services option, see Apple's Directory Services documentation, esp. the Writing Open Directory Plug-ins document.

There are probably other ways, but these are the two that jumped to mind.

share|improve this answer
Upvoted the PAM answer as that should be exponentially easier to implement than either of my suggestions. – morgant Aug 3 '09 at 22:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.