|
You could use public key authentication instead. However, your private key should be protected (on the client) with a passphrase which means typing in the passphrase at least once. If you use public key authentication, and ssh-agent & ssh-add on the client, you only need to enter the passphrase once on the client. The passphrase or decrypted private key shouldn't exist anywhere.
but in your head.
---
Using username/password challenge authentication is not as secure but if that is what you want to do, look at enabling PAM authentication. AFAIK, if both the client and server use AD/LDAP authentication then the ChallengeResponse ssh authentication will look to PAM to ok the login. Some disto's like SuSE have a wizard in the Users & Groups setup to set this up for you.
Also, enter the terms: "linux pam ldap ssh sso" into google. You will come up with a number of howto pages.
---
I wouldn't recommend this however. Using password authentication allows brute force attacks. Using public key authentication without a passphrase protected private key is dangerous if the private key is stolen. ( This happened to Red Hat recently )
|
