Table of Contents
Here are a couple ways that you could configure your SSH server side, so that folks would use GLAuth for authentication (including 2FA, etc.)
The first way has been around forever but the "newer" way, based on introducing a dependency on sssd is more powerful (in addition to be simpler to set up) -- for instance, it natively supports secondary groups, which is quite important when implementing RBAC!
So, if you are comfortable with this approach, scroll down to the SSSD section.
The old PAM ways
Hey, it may be old, but it works!
Note that, with this setup, LDAP groups will automatically be assigned as Linux groups, same as using NIS (for instance)
Setup
sudo apt-get install -y libpam-ldap nscd
Here are some answers to the prompts you will see during the setup process:
| Prompt | Answer |
|---|---|
| Should debconf...? | Yes |
| LDAP URI | Your GLAuth instance fqdn and port number |
| Distinguished Name | dc=glauth,dc=com (replace with your org's DN) |
| LDAP version | 3 |
| Make local root database admin | Yes |
| Does the LDAP db require login? | No |
| LDAP account for root | cn=serviceuser,ou=svcaccts,dc=glauth,dc=com |
| LDAP root password | {your root user password} |
| Encryption | crypt |
You can reconfigure this later:
sudo dpkg-reconfigure ldap-auth-config
In /etc/nsswitch.conf:
passwd: ldap compat systemd
group: ldap compat systemd
shadow: ldap compat
gshadow: files
In /etc/pam.d/common-session:
session required pam_mkhomedir.so skel=/etc/b-skel umask=0077
Yes, this does create a home directory for each user being authenticated. We use a strong mask so that we can start storing sensitive info, if needed, in their home directory.
Note that we should also create our skeleton directory:
sudo mkdir /etc/b-skel
In /etc/pam.d/common-password, remove use_authtok if present.
Allow password login. Make sure you have, in /etc/ssh/sshd_config:
PasswordAuthentication yes
Security
Now, let's say that you are connecting to GLAuth using LDAPS, but you are using a self-signed cert. Change /etc/ldap/ldap.conf accordingly:
TLS_REQCERT never
You can also restrict access to certain groups.
In /etc/pam.d/common-auth:
auth required pam_access.so
In /etc/security/access.conf:
-:ALL EXCEPT root (admin):ALL EXCEPT LOCAL
Debugging
To debug authentication issues:
sudo tail -f /var/log/auth.log
You can also check from the command line:
sudo getent passwd
sudo getent group
finger {username} # if finger is installed
The modern way, using sssd
First, a tip: make sure that nscd is not installed or you will be pulling your hair for quite a while.
This approach works better if you are forwarding to an AD server, FreeIpa, or other domain-based auth environments.
Create /etc/sssd/conf.d/auth-something.conf. Note that group enforcement takes place in this same file:
[sssd]
config_file_version = 2
services = nss, pam, ssh
domains = MYDOMAIN
[nss]
[pam]
[domain/MYDOMAIN]
#cache_credentials = True
enumerate = False
id_provider = ldap
auth_provider = ldap
access_provider = ldap
ldap_uri = {auth_uri}
ldap_search_base = dc=glauth,dc=com
ldap_default_bind_dn = cn=serviceuser,ou=svcaccts,dc=glauth,dc=com
ldap_default_authtok_type = password
ldap_default_authtok = {your root user password}
ldap_tls_cacert = /etc/ssl/certs/auth-yourcert.crt
sudo_provider = none
ldap_group_member = member
ldap_schema = rfc2307bis
ldap_access_order = filter
ldap_access_filter = (memberOf=ou=svcaccts,dc=glauth,dc=com)
In /etc/ldap/ldap.conf, remove this line:
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
and replace it with:
TLS_CACERT /etc/ssl/certs/auth-yourcert.crt
Same as above, create a home directory on demand. In /etc/pam.d/common-session:
session. required. pam_mkhomedir.so umask=0077
Do not forget to install, start and enable the sssd service. Done.