3

I recently setup gitolite, where users access git repository with "gitolite" user through ssh.

Now I would like to integrate that into LDAP. Each user has pubkey in LDAP and if he has "git" objectClass, he would be able to access "gitolite" user through ssh.

I know it's possible to store public keys in LDAP, I'm not sure if it possible to allow authentication in "gitosis" account based on objectClass.

EDIT: To clarify, with objectClass git, user "foobar" would be able to login as "gitolite" through ssh

Improve this question

2 Answers 2

Reset to default
1

The author of gitolite has added some features that help support external key stores and group membership information. Search the CHANGELOG for LDAP.

To use an external key store your sshd needs to support the usual .ssh/authorized_keys file (this is the file that tells sshd to run gl-auth-command when a gitolite user logs in).

  1. Turn off the normal authkey generation (the one based on the keydir in the gitolite-admin repository):
    $GL_NO_SETUP_AUTHKEYS = 0; in your .gitolite.rc.
  2. Periodically (any time a key is changed, a user is added, etc.):
    1. Extract all the SSH keys from your key store into some convenient, temporary directory (use the same names for key files as if they were in the normal repository-based keydir).
    2. Run gl-setup-authkeys to have gitolite rebuild its part of the authorized_keys file.

See the commit message that introduced gl-setup-authkeys for the author’s own description.

Using externally defined user groups is a bit trickier since it usually involves interposing another program between sshd and gl-auth-command (the group memberships are passed as extra arguments to gl-auth-command). See “usergroups and LDAP/similar tools”.

Improve this answer
2
  • I was thinking of using patched SSH that looks into LDAP for ssh pub key. code.google.com/p/openssh-lpk/wiki/Main
    – iElectric
    Sep 11, 2010 at 20:42
  • The only part of mystery to be solved is how to hook LDAP to update "gitolite" user on any ssh pub key modification. There seems to be overlays and other not-so-welcome method in OpenLDAP to provide triggers. Any ideas?
    – iElectric
    Sep 11, 2010 at 20:45
0

If you wanted to try something a little off the wall, you make .ssh/authorized_keys2 be a named pipe and write a script/program that queries LDAP, performs the proper filtering, and then spits out the contents of an authorized_keys keys. I suggest authorized_keys2 since you're probably using authorized_keys already.

You'd have to be careful with the script (watch for blocking writes, know when to do a fresh query, etc.) but it would give you the right answer every time if you did it right.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .