openssh unix dev - Feb 2005 - Multiple servers, restricting user commands and LDAP

I have a set-up of 3 servers at disparate geographical locations.

Server 1 provides web services, and users should be able to use sftp
only. Admins should be able to get shells.
Server 2 provides CVS services, and users sh ould be able to use cvs
only. Admins should be able to get shells.
Server 3 provides shell services for all users.

There appears to be no easy way of implementing this within the
current OpenSSH system. At this point in time, for various reasons,
each server maintains its own authentication database, which are
periodically regenerated from a master SQL database of users and
groups (and other stuff). Another set of scripts generate
.ssh/authorized_keys files and rsync them about, creating the correct
command= and so on for each user based on their relative privileges
and the host in question.

For obvious reasons, this is nasty. I am pushing towards moving
everything over to LDAP for authentication and user information. This
includes the public keys, and in fact we have taken over the hosting
of the OpenSSH-LPK project[1] and I plan on contributing resources
towards that end (we've started using our own schema, I'm writing up
an Internet-Draft on it, etc).

Basically, I was wondering if anybody had any input on this situation,
what they'd like to see from any OpenSSH/LDAP integration, and that
kind of thing. It seems that the command= shouldn't necessarily only
be coupled to keys, no?

Has anybody dealt with a similar situation?

[1] http://www.opendarwin.org/projects/openssh-lpk/

 -- Finlay

Finlay Dobbie wrote:
> Basically, I was wondering if anybody had any input on this situation,
> what they'd like to see from any OpenSSH/LDAP integration, and that
> kind of thing. It seems that the command= shouldn't necessarily only
> be coupled to keys, no?
If you want users to be forced to use a specific command, rather than
just forcing a command on a particular key, then you can just make the
command the user's login shell.

-d

Finlay Dobbie wrote:
> 
> On 21 Feb 2005, at 20:42, Damien Miller wrote:
>> If you are using LDAP, then set posixAccount/loginShell appropriately.
> 
> I know how to set a user's shell using the NIS schema. I don't see
how
> that helps me, since I need to have different restricted commands for 
> different hosts. If I could restrict commands by group then that'd be 
> dandy.
You could have the same shell name map to different restrictions on each
host. Trivially, by symlinking the shell to the binary you want to tun
(e.g. /usr/bin/cvs) or, if you wanted to be fancy, you could make that
restricted shell look up the actual commands it is supposed to execute
in LDAP too. That way they user would get a consistent response
regardless of the method by which they logged in.

-d