[SOLVED] Login : Check LDAP Before SSH Key

tkinsella · 01-13-2014, 07:47 PM

How can I configure PAM (or SSHD) To check and see if the user has a valid LDAP account before accepting their SSH Public Key for login?

I have issues where when employees are removed from LDAP, they can still login because they have a public key. I would prefer to have the system check LDAP first so I don't have to focus on removing these keys from 100's of boxes first.

In the meantime I'll write a script to hit each server and remove the key, but this is still hard to manage as servers come and go....

Thanks!

acid_kewpie · 01-14-2014, 02:24 AM

If there is no LDAP account then there shouldn't be enough information provided to get user details in the first place. Where is the user account info coming from? Are they locally created? Sounds like, if this is the case, a home brew system like you suggest may well be the best way in absence of a well managed environment.