> We have patched our SSH daemon to perform public key lookups from our MySQL database
That seems strange, that could be a PAM module at the least. If you patch SSHd then you are burdened with keeping up with changes, etc. There's even a module for direct mysql: http://sourceforge.net/projects/pam-mysql/
It's a phenomenally bizarre way of solving the problem. Not only do you have to maintain patches to sshd (which increases maintenance costs and makes deploying security updates considerably more time consuming), but you also risk introducing security bugs in sshd itself.
There are already plenty of external solutions to this problem that do not involve patching vendor-shipped software, and writing your own is not difficult.
Will synchronize public keys from LDAP to local hosts, automatically create home directories, delete user's home directories when their accounts are deactivated after a grace period, etc -- and you don't have to patch sshd.
Thanks, sorry for the confusion. So what they needed but did not have is an authorization (not authentication) callout after the daemon has verified the remote user's identity (vs. the built in 'callout' of looking at a user's authorized_keys file).
Hmm, I think this part is still about authentication as sshd cannot authenticate the user without the keys. According to the article, GitHub does the authorization in their Gerve script.
This is all sort of pedantic but the way I read the situation is that the only authentication is proving that the entity on the other end possesses the private key associated with a certain public key. The authorization part is two fold: is key X authorized to access account Y. And then it's passed on to Gerve for more specific authorization checks. Having implemented such things, I am probably thinking more about the internal situation, sorry..
Comments
> We have patched our SSH daemon to perform public key lookups from our MySQL database
That seems strange, that could be a PAM module at the least. If you patch SSHd then you are burdened with keeping up with changes, etc. There's even a module for direct mysql: http://sourceforge.net/projects/pam-mysql/
It's a phenomenally bizarre way of solving the problem. Not only do you have to maintain patches to sshd (which increases maintenance costs and makes deploying security updates considerably more time consuming), but you also risk introducing security bugs in sshd itself.
There are already plenty of external solutions to this problem that do not involve patching vendor-shipped software, and writing your own is not difficult.
Here's one -- http://code.google.com/p/splatd/
Will synchronize public keys from LDAP to local hosts, automatically create home directories, delete user's home directories when their accounts are deactivated after a grace period, etc -- and you don't have to patch sshd.
I don't think you can use PAM for authentication if you want to use public key authentication (see auth2-pubkey.c in Portable OpenSSH).
Thanks, sorry for the confusion. So what they needed but did not have is an authorization (not authentication) callout after the daemon has verified the remote user's identity (vs. the built in 'callout' of looking at a user's authorized_keys file).
Hmm, I think this part is still about authentication as sshd cannot authenticate the user without the keys. According to the article, GitHub does the authorization in their Gerve script.
This is all sort of pedantic but the way I read the situation is that the only authentication is proving that the entity on the other end possesses the private key associated with a certain public key. The authorization part is two fold: is key X authorized to access account Y. And then it's passed on to Gerve for more specific authorization checks. Having implemented such things, I am probably thinking more about the internal situation, sorry..