6

I'm looking for a way to authenticate users using a public key which is stored in a db (MongoDB). Similar questions usually resulted with a suggestion to installed a patched version of OpenSSH (https://github.com/wuputahllc/openssh-for-git) which authenticates against a db (GitHub are using a patched version of OpenSSH).

I saw there is a PAM module to authenticate via MySQL, but it assumes a username/password authentication. I was wondering whether I can use some sort of a PAM module to authenticate using a public-key against a server.

EDITED: I need it for a git server where all users will be connecting via the 'git' username. There will be no specific username per user.

Gilad Novik
  • 307
  • 2
  • 3
  • 10

2 Answers2

6

SSH public key authentication is not implemented via PAM. It actually bypasses the PAM auth stack (but only auth), something which many administrators overlook.

Barring versions that support AuthorizedKeyCommand (as mentioned in Florin's answer), the only way to extend SSH public key auth is to patch either the daemon (public key lookups) or the client (private key lookups).

There are plenty of ways you can extend your authentication options via PAM, but modifying how SSH public key authentication works is not one of them.

Andrew B
  • 32,588
  • 12
  • 93
  • 131
6

AuthorizedKeysCommand is what you need. It will require a decently new version of OpenSSH available and you to write a wrapper command that gets the key from the MongoDB database but it will not require you to patch OpenSSH.

And a link with more details about AuthorizedKeysCommand.

Catskul
  • 1,929
  • 4
  • 20
  • 23
Florin Asăvoaie
  • 7,057
  • 23
  • 35
  • Thanks. I forgot to mention the username is identical for all users (git). I've edited the question to explain. – Gilad Novik May 01 '14 at 23:10
  • Florin, I have openssh 1:6.6 on Ubuntu 14.04 and AuthorizedKeysCommand does not seem to be recognized. When I add it and restart my sshd, it says it running, but when I check listening ports, there's nothing listening on port 22, and all ssh requests are rejected. Any ideas? – TheJKFever May 22 '14 at 17:07
  • Check /var/log/messages for errors immediately after restarting ssh. – Florin Asăvoaie May 22 '14 at 19:03