OpenSSH Public Keys
Prev | Chapter 2. Included Modules | Next

## OpenSSH Public Keys

The SSH service module will extract SSH keys from LDAP, optionally create a home directory if it does not already exist, apply any key command limitations specified by the administrator, and atomically overwrite the user's `authorized_keys` file.

### LDAP Schema

To store the SSH keys in LDAP, we created an sshAccount schema in our Three Rings Enterprise OID space. The schema is included with the Splat distribution as `schema/ooossh.schema`. It depends on another included schema: `schema/ooo.schema` . The SSH schema defines a new auxiliary object class, sshAccount and an optional attribute, sshPublicKey. Feel free to use this schema with your own installation.

    attributetype ( oooSSHAttributes:1 NAME 'sshPublicKey'
            DESC 'OpenSSH Public Key'
            EQUALITY octetStringMatch
            SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )

    objectclass ( oooSSHClasses:1 NAME 'sshAccount'
            DESC 'OpenSSH Account'
            SUP top AUXILIARY
            MAY ( sshPublicKey ) )

### SSH Service Options

The SSH service module supports `authorized_keys` command limitations and sanity checking on the uid, gid, and home directory.

#### SSH Service Options

makehome

  Create home directories for users. Set to `true` to enable home directory creation, but be aware that other plugins (such as the `homeDirectory` plugin) may also be configured to create the same home directory, with different options.

home

  Only write keys to subdirectories of the specified directory.

minuid

  Do not write keys for uids lower than minuid.

mingid

  Do not write keys for gids lower than mingid.

command

  Limit user to the specified command.

Prev | Up | Next
Home Directories | Home | User Mail Forward Files