lament/pantheon

ssh: restore key-based login via LDAP sshPublicKey, fleet-wide #122

Merged

lament merged 1 commit from sssd-ssh into main

2026-08-02 00:26:31 -05:00

lament commented

2026-08-02 00:22:29 -05:00

Owner

phone SSH broke when localAccount defaulted to false (PR #120) - that dropped the last static authorizedKeys.keys entry for lament, and nothing replaced it for clients that can't do Kerberos ticket auth (Termux)
openldap.nix: adds the openssh-lpk schema (sshPublicKey/ldapPublicKey) - hand-authored OLC ldif, not extracted like kerberosSchema, since nixpkgs carries no vendored copy of this one. OIDs match sssd's own multihost test fixtures
sssd.nix: enables the ssh service and sshAuthorizedKeysIntegration, so sshd resolves AuthorizedKeysCommand through sss_ssh_authorizedkeys against the new LDAP attribute
lament's uid=lament,ou=people entry got the ldapPublicKey objectClass + sshPublicKey value added by hand via ldapmodify (DIT content, not Nix-managed - same as everything else under ou=people)
verified on all five hosts (verdandi first, then the rest one at a time): sss_ssh_authorizedkeys lament resolves the key post-deploy

left for later: a host that already had lament's entry cached from before the attribute was added needs sss_cache -u lament to pick it up - not needed for the fleet this pass since all five deploys happened after the LDAP write, but worth remembering for the next LDAP-attribute change.

- phone SSH broke when `localAccount` defaulted to `false` (PR #120) - that dropped the last static `authorizedKeys.keys` entry for `lament`, and nothing replaced it for clients that can't do Kerberos ticket auth (Termux) - `openldap.nix`: adds the `openssh-lpk` schema (`sshPublicKey`/`ldapPublicKey`) - hand-authored OLC ldif, not extracted like `kerberosSchema`, since nixpkgs carries no vendored copy of this one. OIDs match sssd's own multihost test fixtures - `sssd.nix`: enables the `ssh` service and `sshAuthorizedKeysIntegration`, so sshd resolves `AuthorizedKeysCommand` through `sss_ssh_authorizedkeys` against the new LDAP attribute - `lament`'s `uid=lament,ou=people` entry got the `ldapPublicKey` objectClass + `sshPublicKey` value added by hand via `ldapmodify` (DIT content, not Nix-managed - same as everything else under `ou=people`) - verified on all five hosts (`verdandi` first, then the rest one at a time): `sss_ssh_authorizedkeys lament` resolves the key post-deploy left for later: a host that already had `lament`'s entry cached from before the attribute was added needs `sss_cache -u lament` to pick it up - not needed for the fleet this pass since all five deploys happened after the LDAP write, but worth remembering for the next LDAP-attribute change.

lament added 1 commit

2026-08-02 00:22:30 -05:00

ssh: restore key-based login via LDAP sshPublicKey, fleet-wide

CI / check (pull_request) Successful in 51s

Details

CI / deploy (pull_request) Has been skipped

Details

CI / build (pull_request) Successful in 2m34s

Details

CI / dry-activate (pull_request) Successful in 28s

Details

CI / check (push) Has been skipped

Details

CI / build (push) Has been skipped

Details

CI / dry-activate (push) Has been skipped

Details

CI / deploy (push) Successful in 2m47s

Details

b171dd31d8

localAccount going false everywhere but verdandi dropped the last static
authorized_keys entry, breaking phone ssh with no ticket-based fallback.
Adds the openssh-lpk schema to openldap and wires sssd's ssh responder +
AuthorizedKeysCommand so sshd reads sshPublicKey straight from LDAP.

lament scheduled this pull request to auto merge when all checks succeed

2026-08-02 00:23:15 -05:00

lament merged commit b171dd31d8 into main

2026-08-02 00:26:31 -05:00

lament deleted branch sssd-ssh

2026-08-02 00:26:31 -05:00

lament added the

fix

security

labels

2026-08-02 00:34:57 -05:00