In Linux (e.g., Ubuntu 18.04), how can I configure sshd
to allow logins using public keys for OS users that do not yet exist?
For example:
On server: /etc/ssh/sshd_config has
AuthorizedKeysFile: /etc/ssh/keys/%u
sudo mkdir -p /etc/ssh/keys
sudo tee /etc/ssh/keys/foo <<< "$(cat id_rsa.pub)"
sudo systemctl restart sshd
On client: ssh foo@server
In this scenario, the server does NOT have a foo
account in /etc/passwd
, but I'd like to create one automatically and then use pam_mkhomedir
to create its home directory -- all because the user can successfully authenticate using a public key.
My attempt:
/etc/pam.d/sshd
comment out@include common-auth
(makes no difference since public keys reportedly bypass this anyway)/etc/pam.d/sshd
comment out@include common-account
(no difference)/etc/pam.d/sshd
add, under #2,account required pam_permit.so
(no difference)/etc/ssh/sshd_config LogLevel: DEBUG3
shows
debug1: userauth-request for user foo
Invalid user foo from 192.168.0.8 port 62083
debug1: PAM: initializing for "foo"
debug1: userauth_pubkey: test whether pkalg/pkblob are acceptable for RSA SHA256:kdI+ALYK88R6zAcoPAIyXctjCLgEkGodgieusIOay0c [preauth]
debug2: userauth_pubkey: disabled because of invalid user [preauth]
bar
to AD, the Linux host doesn't have an /etc/passwd entry yet--i.e., the1:1
mapping (public key to passwd entry) does not exist yet. We need aplugin for PAM
liket3ddftw
mentioned in his answer. Also, we can centralize ssh revocations through AD usingAllow log on locally
with the Linux hosts in an Organizational Unit (OU). The keypair is pre-auth (i.e., pre-PAM), but, for us, SSSD to AD is the "glue".