NameDateSize

..20-Apr-202110

addr.cH A D26-Oct-202310.1 KiB

addr.hH A D28-Jul-20232.4 KiB

addrmatch.cH A D20-Apr-20214.5 KiB

atomicio.cH A D30-Apr-20194.7 KiB

atomicio.hH A D30-Apr-20192.2 KiB

auth-bsdauth.cH A D30-Apr-20193.8 KiB

auth-krb5.cH A D20-Apr-20218.2 KiB

auth-options.cH A D26-Oct-202323.6 KiB

auth-options.hH A D02-Sep-20213.2 KiB

auth-pam.cH A D26-Oct-202337.3 KiB

auth-pam.hH A D26-Oct-20232 KiB

auth-passwd.cH A D08-Jul-20236.1 KiB

auth-rhosts.cH A D28-Jul-20239.3 KiB

auth-skey.cH A D27-Apr-20172.9 KiB

auth.cH A D28-Jul-202324.8 KiB

auth.hH A D06-Oct-20228 KiB

auth2-chall.cH A D06-Mar-202110 KiB

auth2-gss.cH A D26-Oct-20239.9 KiB

auth2-hostbased.cH A D28-Jul-20237.9 KiB

auth2-kbdint.cH A D24-Feb-20222.4 KiB

auth2-krb5.cH A D24-Feb-20222.4 KiB

auth2-none.cH A D28-Jul-20232.3 KiB

auth2-passwd.cH A D06-Oct-20222.6 KiB

auth2-pubkey.cH A D26-Oct-202323.9 KiB

auth2-pubkeyfile.cH A D28-Jul-202316.4 KiB

auth2.cH A D21-Dec-202323.5 KiB

authfd.cH A D21-Dec-202319.8 KiB

authfd.hH A D21-Dec-20234.1 KiB

authfile.cH A D28-Jul-202312.5 KiB

authfile.hH A D27-Feb-20202.5 KiB

bcrypt_pbkdf.cH A D27-Apr-20175.3 KiB

bitmap.cH A D30-Apr-20194.6 KiB

bitmap.hH A D30-Apr-20192 KiB

blf.hH A D07-Apr-20183.6 KiB

blowfish.cH A D27-Apr-201723.2 KiB

canohost.cH A D26-Oct-20234 KiB

canohost.hH A D27-Apr-2017837

chacha.cH A D26-Oct-20235.4 KiB

chacha.hH A D20-Apr-20211 KiB

channels.cH A D21-Dec-2023144.4 KiB

channels.hH A D21-Dec-202315.2 KiB

cipher-aesctr.cH A D07-Apr-20182.2 KiB

cipher-aesctr.hH A D07-Apr-20181.4 KiB

cipher-chachapoly-libcrypto.cH A D26-Oct-20234.9 KiB

cipher-chachapoly.cH A D26-Oct-20234.1 KiB

cipher-chachapoly.hH A D29-May-20201.6 KiB

cipher-ctr-mt.cH A D30-Apr-201911.2 KiB

cipher.cH A D21-Dec-202313.8 KiB

cipher.hH A D21-Dec-20233.2 KiB

cleanup.cH A D30-Apr-20191.1 KiB

clientloop.cH A D21-Dec-202383.5 KiB

clientloop.hH A D29-May-20203.8 KiB

compat.cH A D28-Jul-20235.2 KiB

compat.hH A D28-Jul-20232.6 KiB

crypto_api.hH A D28-Jul-20231.7 KiB

dh.cH A D20-Apr-202115.4 KiB

dh.hH A D20-Apr-20212.7 KiB

digest-libc.cH A D29-May-20205.7 KiB

digest-openssl.cH A D06-Mar-20214.8 KiB

digest.hH A D06-Mar-20212.6 KiB

dispatch.cH A D28-Jul-20233.6 KiB

dispatch.hH A D30-Apr-20192 KiB

dns.cH A D28-Jul-20239 KiB

dns.hH A D28-Jul-20232.1 KiB

ed25519.cH A D28-Jul-2023196.9 KiB

ed25519.shH A D26-Jul-20234.1 KiB

fatal.cH A D06-Mar-20211.9 KiB

fmt_scaled.cH A D30-Apr-20197.4 KiB

fmt_scaled.hH A D30-Apr-2019211

freezero.cH A D06-Apr-20181.1 KiB

getpeereid.cH A D27-Apr-20171.9 KiB

getpeereid.hH A D27-Apr-2017304

getrrsetbyname.cH A D13-Nov-202013.9 KiB

getrrsetbyname.hH A D27-Apr-20173.7 KiB

groupaccess.cH A D30-Apr-20193.3 KiB

groupaccess.hH A D27-Apr-20171.6 KiB

gss-genr.cH A D06-Mar-20217.9 KiB

gss-serv-krb5.cH A D30-Apr-20195.3 KiB

gss-serv.cH A D29-May-202010.5 KiB

hash.cH A D27-Feb-2020819

hmac.cH A D29-May-20205.1 KiB

hmac.hH A D07-Apr-20181.7 KiB

hostfile.cH A D28-Jul-202324.7 KiB

hostfile.hH A D06-Mar-20214.4 KiB

includes.hH A D03-Sep-2021407

kex.cH A D21-Dec-202343.9 KiB

kex.hH A D21-Dec-20238.8 KiB

kexc25519.cH A D30-Apr-20195.8 KiB

kexdh.cH A D06-Mar-20215 KiB

kexecdh.cH A D30-Apr-20195.6 KiB

kexgen.cH A D24-Feb-202210.5 KiB

kexgex.cH A D30-Apr-20193.7 KiB

kexgexc.cH A D24-Feb-20227.1 KiB

kexgexs.cH A D26-Oct-20236.4 KiB

kexsntrup761x25519.cH A D24-Feb-20227.1 KiB

krl.cH A D26-Oct-202335.8 KiB

krl.hH A D26-Oct-20232.7 KiB

ldapauth.cH A D15-Aug-202115.9 KiB

ldapauth.hH A D15-Aug-20214.5 KiB

LICENCEH A D08-Jul-20239.1 KiB

log.cH A D21-Dec-202311.3 KiB

log.hH A D20-Apr-20217 KiB

lpk-user-example.txtH A D21-Nov-20103.7 KiB

mac.cH A D13-Oct-20197.3 KiB

mac.hH A D27-Apr-20172 KiB

match.cH A D26-Oct-20239.6 KiB

match.hH A D05-Dec-20201.3 KiB

md-sha256.cH A D27-Apr-20172.1 KiB

misc.cH A D21-Dec-202363 KiB

misc.hH A D21-Dec-20239 KiB

moduliH A D26-Oct-2023573.3 KiB

moduli-gen/H21-Dec-202311

moduli.5H A D26-Oct-20234.7 KiB

moduli.cH A D28-Jul-202320.7 KiB

monitor.cH A D26-Oct-202351 KiB

monitor.hH A D28-Jul-20234.5 KiB

monitor_fdpass.cH A D06-Mar-20214.1 KiB

monitor_fdpass.hH A D27-Apr-20171.6 KiB

monitor_wrap.cH A D21-Dec-202327.1 KiB

monitor_wrap.hH A D06-Oct-20224 KiB

msg.cH A D06-Mar-20212.9 KiB

msg.hH A D27-Apr-20171.5 KiB

mux.cH A D21-Dec-202362.7 KiB

myproposal.hH A D16-Apr-20223.9 KiB

namespace.hH A D03-Sep-20213.7 KiB

nchan.cH A D24-Feb-202211.8 KiB

nchan.msH A D27-Dec-20163.9 KiB

nchan2.msH A D27-Dec-20163.4 KiB

openssh-lpk_openldap.schemaH A D21-Nov-2010537

openssh-lpk_sun.schemaH A D21-Nov-2010609

OVERVIEWH A D30-Apr-20196.2 KiB

packet.cH A D21-Dec-202372.4 KiB

packet.hH A D21-Dec-20237.4 KiB

pathnames.hH A D27-Feb-20205.7 KiB

pfilter.cH A D15-Jun-2020903

pfilter.hH A D07-Apr-2018118

pkcs11.hH A D27-Apr-201741.4 KiB

poly1305.cH A D26-Oct-20234.7 KiB

poly1305.hH A D07-Apr-2018712

progressmeter.cH A D26-Oct-20237.9 KiB

progressmeter.hH A D30-Apr-20191.5 KiB

PROTOCOLH A D21-Dec-202327.8 KiB

PROTOCOL.agentH A D21-Dec-20234.3 KiB

PROTOCOL.certkeysH A D02-Sep-202112.9 KiB

PROTOCOL.chacha20poly1305H A D29-May-20204.5 KiB

PROTOCOL.keyH A D06-Oct-20221.6 KiB

PROTOCOL.krlH A D26-Oct-20236.9 KiB

PROTOCOL.muxH A D24-Feb-20228.9 KiB

PROTOCOL.sshsigH A D05-Dec-20203.3 KiB

PROTOCOL.u2fH A D05-Dec-202010.8 KiB

random.hH A D27-Apr-20171.6 KiB

readconf.cH A D21-Dec-2023107.3 KiB

readconf.hH A D21-Dec-20239.9 KiB

READMEH A D27-Dec-2016917

README.lpkH A D21-Nov-201010.6 KiB

readpass.cH A D06-Oct-20228.4 KiB

readpassphrase.3H A D27-Apr-20173.6 KiB

readpassphrase.cH A D30-Apr-20194.6 KiB

readpassphrase.hH A D27-Apr-20172.2 KiB

recallocarray.cH A D09-Mar-20192.4 KiB

rijndael.cH A D30-Apr-201951.7 KiB

rijndael.hH A D24-Feb-20221.7 KiB

sandbox-pledge.cH A D06-Mar-20211.9 KiB

sandbox-rlimit.cH A D06-Mar-20212.3 KiB

scp.1H A D01-Dec-20238 KiB

scp.cH A D21-Dec-202352.6 KiB

servconf.cH A D21-Dec-2023102.9 KiB

servconf.hH A D26-Oct-202312.4 KiB

serverloop.cH A D26-Oct-202329.5 KiB

serverloop.hH A D13-Oct-20171 KiB

session.cH A D26-Oct-202362.7 KiB

session.hH A D28-Jul-20232.7 KiB

sftp-client.cH A D21-Dec-202378.7 KiB

sftp-client.hH A D26-Oct-20236.5 KiB

sftp-common.cH A D26-Oct-20237.1 KiB

sftp-common.hH A D06-Oct-20222.1 KiB

sftp-glob.cH A D26-Oct-20233.8 KiB

sftp-realpath.cH A D28-Sep-20216 KiB

sftp-server-main.cH A D13-Oct-20191.6 KiB

sftp-server.8H A D02-Sep-20215 KiB

sftp-server.cH A D26-Oct-202351 KiB

sftp-usergroup.cH A D26-Oct-20235.8 KiB

sftp-usergroup.hH A D05-Oct-20221.1 KiB

sftp.1H A D01-Dec-202317 KiB

sftp.cH A D26-Oct-202363.7 KiB

sftp.hH A D27-Apr-20173.4 KiB

sk-api.hH A D06-Oct-20222.8 KiB

sk-usbhid.cH A D26-Oct-202334.7 KiB

smult_curve25519_ref.cH A D27-Apr-20176.8 KiB

sntrup761.cH A D28-Jul-202325.4 KiB

sntrup761.shH A D28-Jul-20232.8 KiB

srclimit.cH A D20-Apr-20213.9 KiB

srclimit.hH A D05-Mar-2021895

ssh-add.1H A D21-Dec-202310.6 KiB

ssh-add.cH A D21-Dec-202326.9 KiB

ssh-agent.1H A D26-Oct-20238.1 KiB

ssh-agent.cH A D21-Dec-202364.9 KiB

ssh-dss.cH A D28-Jul-202311.7 KiB

ssh-ecdsa-sk.cH A D28-Jul-202313.3 KiB

ssh-ecdsa.cH A D28-Jul-202312 KiB

ssh-ed25519-sk.cH A D28-Jul-20237.7 KiB

ssh-ed25519.cH A D28-Jul-20237.9 KiB

ssh-gss.hH A D06-Mar-20214.3 KiB

ssh-keygen.1H A D26-Oct-202341.1 KiB

ssh-keygen.cH A D26-Oct-2023106.4 KiB

ssh-keyscan.1H A D28-Jul-20234.8 KiB

ssh-keyscan.cH A D26-Oct-202319.9 KiB

ssh-keysign.8H A D16-Apr-20223 KiB

ssh-keysign.cH A D06-Oct-20228.2 KiB

ssh-pkcs11-client.cH A D21-Dec-202316.5 KiB

ssh-pkcs11-helper.8H A D28-Jul-20231.8 KiB

ssh-pkcs11-helper.cH A D24-Feb-202210.2 KiB

ssh-pkcs11.cH A D26-Oct-202346.3 KiB

ssh-pkcs11.hH A D21-Dec-20231.8 KiB

ssh-rsa.cH A D28-Jul-202319.6 KiB

ssh-sandbox.hH A D07-Apr-20181.1 KiB

ssh-sk-client.cH A D24-Feb-202211.3 KiB

ssh-sk-helper.8H A D06-Oct-20221.7 KiB

ssh-sk-helper.cH A D28-Jul-202310 KiB

ssh-sk.cH A D26-Oct-202322.2 KiB

ssh-sk.hH A D24-Feb-20222.7 KiB

ssh-xmss.cH A D28-Jul-202310.2 KiB

ssh.1H A D21-Dec-202346.4 KiB

ssh.cH A D21-Dec-202375.1 KiB

ssh.hH A D05-Dec-20202.9 KiB

ssh2.hH A D21-Dec-20235.9 KiB

ssh_api.cH A D28-Jul-202314.6 KiB

ssh_api.hH A D30-Apr-20194.4 KiB

ssh_configH A D26-Oct-20231.8 KiB

ssh_config.5H A D21-Dec-202366.7 KiB

sshbuf-getput-basic.cH A D06-Oct-202212.3 KiB

sshbuf-getput-crypto.cH A D06-Oct-20224.3 KiB

sshbuf-io.cH A D26-Feb-20202.9 KiB

sshbuf-misc.cH A D24-Feb-20227.1 KiB

sshbuf.cH A D28-Jul-20239.9 KiB

sshbuf.hH A D28-Jul-202313.6 KiB

sshconnect.cH A D21-Dec-202350.4 KiB

sshconnect.hH A D21-Dec-20233.2 KiB

sshconnect2.cH A D21-Dec-202368.8 KiB

sshd.8H A D26-Oct-202331.2 KiB

sshd.cH A D21-Dec-202364.6 KiB

sshd_configH A D10-May-20224 KiB

sshd_config.5H A D26-Oct-202359.6 KiB

ssherr.cH A D21-Oct-20225.4 KiB

ssherr.hH A D27-Feb-20203.4 KiB

sshkey-xmss.cH A D03-Aug-202329.8 KiB

sshkey-xmss.hH A D28-Jul-20232.9 KiB

sshkey.cH A D21-Dec-202390.1 KiB

sshkey.hH A D26-Oct-202312.1 KiB

sshlogin.cH A D06-Mar-20218.5 KiB

sshlogin.hH A D27-Apr-2017851

sshpty.cH A D13-Oct-20195 KiB

sshpty.hH A D27-Apr-20171.1 KiB

sshsig.cH A D21-Dec-202329.5 KiB

sshsig.hH A D24-Feb-20224 KiB

sshtty.cH A D27-Apr-20173.1 KiB

ttymodes.cH A D06-Mar-20219.4 KiB

ttymodes.hH A D13-Oct-20174.9 KiB

uidswap.cH A D13-Oct-20194.9 KiB

uidswap.hH A D30-Apr-2019746

umac.cH A D28-Jul-202345.5 KiB

umac.hH A D24-Feb-20224.6 KiB

umac128.cH A D30-Aug-2018340

utf8.cH A D29-May-20207.1 KiB

utf8.hH A D20-Apr-20211.4 KiB

version.hH A D21-Dec-2023528

xmalloc.cH A D16-Apr-20222.6 KiB

xmalloc.hH A D21-Dec-20231.2 KiB

xmss_commons.cH A D06-Apr-2018696

xmss_commons.hH A D06-Apr-2018441

xmss_fast.cH A D06-Apr-201832.2 KiB

xmss_fast.hH A D06-Apr-20183.7 KiB

xmss_hash.cH A D06-Oct-20223.4 KiB

xmss_hash.hH A D06-Apr-2018869

xmss_hash_address.cH A D06-Apr-20181.3 KiB

xmss_hash_address.hH A D06-Apr-2018846

xmss_wots.cH A D30-Apr-20194.8 KiB

xmss_wots.hH A D06-Apr-20181.8 KiB

README

1This release of OpenSSH is for OpenBSD systems only.
2
3Please read
4	http://www.openssh.com/portable.html
5if you want to install OpenSSH on other operating systems.
6
7To extract and install this release on your OpenBSD system use:
8
9      # cd /usr/src/usr.bin
10      # tar xvfz .../openssh-x.y.tgz
11      # cd ssh
12      # make obj
13      # make cleandir
14      # make depend
15      # make
16      # make install
17      # cp ssh_config sshd_config /etc/ssh
18
19OpenSSH is a derivative of the original and free ssh 1.2.12 release
20by Tatu Ylonen.  Aaron Campbell, Bob Beck, Markus Friedl, Niels
21Provos, Theo de Raadt and Dug Song removed many bugs, re-added newer
22features and created OpenSSH.  Markus Friedl contributed the support
23for SSH protocol versions 1.5 and 2.0.
24
25See http://www.openssh.com/ for more information.
26
27$OpenBSD: README,v 1.7 2006/04/01 05:37:46 djm Exp $
28$NetBSD: README,v 1.5 2016/12/25 00:07:46 christos Exp $
29

README.lpk

1OpenSSH LDAP PUBLIC KEY PATCH 
2Copyright (c) 2003 Eric AUGE (eau@phear.org)
3All rights reserved.
4
5Redistribution and use in source and binary forms, with or without
6modification, are permitted provided that the following conditions
7are met:
81. Redistributions of source code must retain the above copyright
9   notice, this list of conditions and the following disclaimer.
102. Redistributions in binary form must reproduce the above copyright
11   notice, this list of conditions and the following disclaimer in the
12   documentation and/or other materials provided with the distribution.
133. The name of the author may not be used to endorse or promote products
14   derived from this software without specific prior written permission.
15
16THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26
27purposes of this patch:
28
29This patch would help to have authentication centralization policy
30using ssh public key authentication.
31This patch could be an alternative to other "secure" authentication system
32working in a similar way (Kerberos, SecurID, etc...), except the fact 
33that it's based on OpenSSH and its public key abilities.
34
35>> FYI: <<
36'uid': means unix accounts existing on the current server
37'lpkServerGroup:' mean server group configured on the current server ('lpkServerGroup' in sshd_config)
38
39example schema:
40
41
42                                  server1 (uid: eau,rival,toto) (lpkServerGroup: unix)
43                ___________      /
44               /           \ --- - server3 (uid: eau, titi) (lpkServerGroup: unix)
45              | LDAP Server |    \
46	      | eau  ,rival |     server2 (uid: rival, eau) (lpkServerGroup: unix)
47	      | titi ,toto  |
48	      | userx,....  |         server5 (uid: eau)  (lpkServerGroup: mail)
49               \___________/ \       /
50	                       ----- - server4 (uid: eau, rival)  (no group configured)
51			             \
52				        etc...
53
54- WHAT WE NEED :
55
56  * configured LDAP server somewhere on the network (i.e. OpenLDAP)
57  * patched sshd (with this patch ;)
58  * LDAP user(/group) entry (look at users.ldif (& groups.ldif)):
59        User entry:
60	- attached to the 'ldapPublicKey' objectclass
61	- attached to the 'posixAccount' objectclass
62	- with a filled 'sshPublicKey' attribute 
63	Example:
64		dn: uid=eau,ou=users,dc=cuckoos,dc=net
65		objectclass: top
66		objectclass: person
67		objectclass: organizationalPerson
68		objectclass: posixAccount
69		objectclass: ldapPublicKey
70		description: Eric AUGE Account
71		userPassword: blah
72		cn: Eric AUGE
73		sn: Eric AUGE
74		uid: eau
75		uidNumber: 1034
76		gidNumber: 1
77		homeDirectory: /export/home/eau
78		sshPublicKey: ssh-dss AAAAB3...
79		sshPublicKey: ssh-dss AAAAM5...
80
81	Group entry:
82	- attached to the 'posixGroup' objectclass
83	- with a 'cn' groupname attribute
84	- with multiple 'memberUid' attributes filled with usernames allowed in this group
85	Example:
86		# few members
87		dn: cn=unix,ou=groups,dc=cuckoos,dc=net
88		objectclass: top
89		objectclass: posixGroup
90		description: Unix based servers group
91		cn: unix
92		gidNumber: 1002
93		memberUid: eau
94		memberUid: user1
95		memberUid: user2
96
97
98- HOW IT WORKS :
99
100  * without patch
101  If a user wants to authenticate to log in a server the sshd, will first look for authentication method allowed (RSAauth,kerberos,etc..)
102  and if RSAauth and tickets based auth fails, it will fallback to standard password authentication (if enabled).
103
104  * with the patch
105  If a user want to authenticate to log in a server, the sshd will first look for auth method including LDAP pubkey, if the ldappubkey options is enabled.
106  It will do an ldapsearch to get the public key directly from the LDAP instead of reading it from the server filesystem. 
107  (usually in $HOME/.ssh/authorized_keys)
108
109  If groups are enabled, it will also check if the user that wants to login is in the group of the server he is trying to log into.
110  If it fails, it falls back on RSA auth files ($HOME/.ssh/authorized_keys), etc.. and finally to standard password authentication (if enabled).
111
112  7 tokens are added to sshd_config :
113  # here is the new patched ldap related tokens
114  # entries in your LDAP must be posixAccount & strongAuthenticationUser & posixGroup
115  UseLPK yes								# look the pub key into LDAP
116  LpkServers ldap://10.31.32.5/ ldap://10.31.32.4 ldap://10.31.32.3	# which LDAP server for users ? (URL format)
117  LpkUserDN  ou=users,dc=foobar,dc=net					# which base DN for users ?
118  LpkGroupDN ou=groups,dc=foobar,dc=net					# which base DN for groups ? 
119  LpkBindDN cn=manager,dc=foobar,dc=net					# which bind DN ?
120  LpkBindPw asecret							# bind DN credidentials
121  LpkServerGroup agroupname						# the group the server is part of
122
123  Right now i'm using anonymous binding to get public keys, because getting public keys of someone doesn't impersonate him� but there is some
124  flaws you have to take care of.
125
126- HOW TO INSERT A USER/KEY INTO AN LDAP ENTRY
127
128  * my way (there is plenty :)
129  - create ldif file (i.e. users.ldif)
130  - cat ~/.ssh/id_dsa.pub OR cat ~/.ssh/id_rsa.pub OR cat ~/.ssh/identity.pub
131  - my way in 4 steps :
132  Example:
133
134  # you add this to the user entry in the LDIF file :
135  [...]
136  objectclass: posixAccount
137  objectclass: ldapPublicKey
138  [...]
139  sshPubliKey: ssh-dss AAAABDh12DDUR2...
140  [...]
141
142  # insert your entry and you're done :)
143  ldapadd -D balblabla -w bleh < file.ldif 
144  
145  all standard options can be present in the 'sshPublicKey' attribute.
146
147- WHY :
148
149  Simply because, i was looking for a way to centralize all sysadmins authentication, easily,  without completely using LDAP 
150  as authentication method (like pam_ldap etc..).  
151  
152  After looking into Kerberos, SecurID, and other centralized secure authentications systems, the use of RSA and LDAP to get 
153  public key for authentication allows us to control who has access to which server (the user needs an account and to be in 'strongAuthenticationUser'
154  objectclass within LDAP and part of the group the SSH server is in). 
155
156  Passwords update are no longer a nightmare for a server farm (key pair passphrase is stored on each user's box and private key is locally encrypted using his passphrase 
157  so each user can change it as much as he wants). 
158
159  Blocking a user account can be done directly from the LDAP (if sshd is using RSAAuth + ldap only).
160
161- RULES :  
162  Entry in the LDAP server must respect 'posixAccount' and 'ldapPublicKey' which are defined in core.schema. 
163  and the additionnal lpk.schema.
164
165  This patch could allow a smooth transition between standard auth (/etc/passwd) and complete LDAP based authentication 
166  (pamldap, nss_ldap, etc..).
167
168  This can be an alternative to other (old?/expensive?) authentication methods (Kerberos/SecurID/..).
169  
170  Referring to schema at the beginning of this file if user 'eau' is only in group 'unix'
171  'eau' would ONLY access 'server1', 'server2', 'server3' AND 'server4' BUT NOT 'server5'.
172  If you then modify the LDAP 'mail' group entry to add 'memberUid: eau' THEN user 'eau' would be able
173  to log in 'server5' (i hope you got the idea, my english is bad :).
174
175  Each server's sshd is patched and configured to ask the public key and the group infos in the LDAP
176  server.
177  When you want to allow a new user to have access to the server parc, you just add him an account on 
178  your servers, you add his public key into his entry on the LDAP server, it's done. 
179
180  Because sshds are looking public keys into the LDAP directly instead of a file ($HOME/.ssh/authorized_keys).
181
182  When the user needs to change his passphrase he can do it directly from his workstation by changing 
183  his own key set lock passphrase, and all servers are automatically aware.
184 
185  With a CAREFUL LDAP server configuration you could allow a user to add/delete/modify his own entry himself
186  so he can add/modify/delete himself his public key when needed.
187
188� FLAWS :
189  LDAP must be well configured, getting the public key of some user is not a problem, but if anonymous LDAP 
190  allow write to users dn, somebody could replace someuser's public key by its own and impersonate some 
191  of your users in all your server farm be VERY CAREFUL.
192  
193  MITM attack when sshd is requesting the public key, could lead to a compromise of your servers allowing login 
194  as the impersonnated user.
195
196  If LDAP server is down then, fallback on passwd auth.
197  
198  the ldap code part has not been well audited yet.
199
200- LDAP USER ENTRY EXAMPLES (LDIF Format, look in users.ldif)
201    --- CUT HERE ---
202    dn: uid=jdoe,ou=users,dc=foobar,dc=net
203    objectclass: top
204    objectclass: person
205    objectclass: organizationalPerson
206    objectclass: posixAccount
207    objectclass: ldapPublicKey
208    description: My account
209    cn: John Doe
210    sn: John Doe
211    uid: jdoe
212    uidNumber: 100
213    gidNumber: 100
214    homeDirectory: /home/jdoe
215    sshPublicKey: ssh-dss AAAAB3NzaC1kc3MAAAEBAOvL8pREUg9wSy/8+hQJ54YF3AXkB0OZrXB....
216    [...]
217    --- CUT HERE ---
218
219- LDAP GROUP ENTRY EXAMPLES (LDIF Format, look in groups.ldif)
220    --- CUT HERE ---
221    dn: cn=unix,ou=groups,dc=cuckoos,dc=net
222    objectclass: top
223    objectclass: posixGroup
224    description: Unix based servers group
225    cn: unix
226    gidNumber: 1002
227    memberUid: jdoe
228    memberUid: user1
229    memberUid: user2
230    [...]
231    --- CUT HERE ---
232
233>> FYI: << 
234Multiple 'sshPublicKey' in a user entry are allowed, as well as multiple 'memberUid' attributes in a group entry
235
236- COMPILING:
237  1. Apply the patch
238  2. ./configure --with-your-options --with-ldap=/prefix/to/ldap_libs_and_includes
239  3. make
240  4. it's done.
241
242- BLA :
243  I hope this could help, and i hope to be clear enough,, or give ideas.  questions/comments/improvements are welcome.
244  
245- TODO :
246  Redesign differently.
247
248- DOCS/LINK :
249  http://pacsec.jp/core05/psj05-barisani-en.pdf
250  http://fritz.potsdam.edu/projects/openssh-lpk/
251  http://fritz.potsdam.edu/projects/sshgate/
252  http://dev.inversepath.com/trac/openssh-lpk
253  http://lam.sf.net/ ( http://lam.sourceforge.net/documentation/supportedSchemas.htm )
254
255- CONTRIBUTORS/IDEAS/GREETS :
256  - Falk Siemonsmeier.
257  - Jacob Rief.
258  - Michael Durchgraf.
259  - frederic peters.
260  - Finlay dobbie.
261  - Stefan Fisher.
262  - Robin H. Johnson.
263  - Adrian Bridgett.
264
265- CONTACT :
266  - Eric AUGE <eau@phear.org>
267  - Andrea Barisani <andrea@inversepath.com>
268