Is it possible to set up ssh and Active Directory (Win2008r2 flavour) such that domain-users can access *nix and ssh-servers-running-on-Windows-servers without needing to type their password?

If so, how?

I've found some documentation that suggests that it (or something like it) is possible by modifying the AD schema to make room for a public-key.

However, most of the concepts themselves are new to me, because really, I'm a developer masquerading as a sysadmin in a dev-ops team.

Context: we have some Windows boxes, and some *nix boxes, and we want to run some remote-admin automation on both sets of them in a continuous-deployment type scenario as well as an ad-hoc maintenance-from-a-central-place type scenario.

3 Answers 3


I have attempted the exact same thing as you have, specifically attempting to manage Linux and Windows with the same toolset, and have found nothing but pain and frustration. The two are so very different in setup, outlook, and design assumptions that tools that work well on one (SSH, PowerShell) are ugly, fragile hacks on the other platform (yes, there exists a PowerShell for Linux, written in Mono). The fragility has pushed us to use two separate deployment systems for our Windows and Linux systems. I don't know of any existing tool that can do both, though I know of a couple who are adamantly trying (both Chef and Puppet is reported to be working on such a Grand Unified Management Framework, Chef has delivered).

My advise, especially since you seem to be a Linux-first organization, is see what kind of hooks you can find for accessing the Windows Remote Management framework ("winrm" is the keyword). It's kerberized SOAP calls over HTTP at the base, so is actually a lot easier on the remote system than installing SSH servers on your Windows machines. Ruby has a gem that'll do it. WinRM is interesting because it is Microsoft's designated "run commands on remote machines" framework, which is what you're attempting to use SSH for, and theoretically offers either cmd.exe or PowerShell as a command-interpreter.

  • Actually, we're a Windows-first organisation that is gradually learning that there's more to life than a faintly-blue-tinted GUI and RSI from clicking on things. We just also have a lot of legacy constraints (in more than the tech sense), and it was in fact easier to get going with deployment automation in ruby over ssh than it would have been with a pure MS toolset (essentially what we have is the result of a developer throwing his arms up in the air and saying to hell with the lack of progress with anything else). Thanks for the reply; hadn't realised chef had shipped... Oct 24, 2011 at 21:50
  • Chef shipped today, so I am not surprised you hadn't heard. My first version of this post didn't have it yet.
    – sysadmin1138
    Oct 25, 2011 at 1:16

I have a setup that indirectly achieves the same purpose for some of my systems. SSH access to the target systems is via public/private key only. The keys are stored on a network share which is accessible only to those permitted to have access. Kind of simple and crude but quite effective. Of course there's nothing to prevent an authorised user from copying the key(s) but only trusted users have access anyway.


Another way of doing this is the way I am doing it which is with a combination of samba with winbind to add the system to aduc and use kerberos for single sign on.I have several guides if you are I interested.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.