6

I'm looking for a way to authenticate users using a public key which is stored in a db (MongoDB). Similar questions usually resulted with a suggestion to installed a patched version of OpenSSH (https://github.com/wuputahllc/openssh-for-git) which authenticates against a db (GitHub are using a patched version of OpenSSH).

I saw there is a PAM module to authenticate via MySQL, but it assumes a username/password authentication. I was wondering whether I can use some sort of a PAM module to authenticate using a public-key against a server.

EDITED: I need it for a git server where all users will be connecting via the 'git' username. There will be no specific username per user.

6

SSH public key authentication is not implemented via PAM. It actually bypasses the PAM auth stack (but only auth), something which many administrators overlook.

Barring versions that support AuthorizedKeyCommand (as mentioned in Florin's answer), the only way to extend SSH public key auth is to patch either the daemon (public key lookups) or the client (private key lookups).

There are plenty of ways you can extend your authentication options via PAM, but modifying how SSH public key authentication works is not one of them.

| improve this answer | |
6

AuthorizedKeysCommand is what you need. It will require a decently new version of OpenSSH available and you to write a wrapper command that gets the key from the MongoDB database but it will not require you to patch OpenSSH.

And a link with more details about AuthorizedKeysCommand.

| improve this answer | |
  • Thanks. I forgot to mention the username is identical for all users (git). I've edited the question to explain. – Gilad Novik May 1 '14 at 23:10
  • Florin, I have openssh 1:6.6 on Ubuntu 14.04 and AuthorizedKeysCommand does not seem to be recognized. When I add it and restart my sshd, it says it running, but when I check listening ports, there's nothing listening on port 22, and all ssh requests are rejected. Any ideas? – TheJKFever May 22 '14 at 17:07
  • Check /var/log/messages for errors immediately after restarting ssh. – Florin Asăvoaie May 22 '14 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.