search for: aaaab3nzac1yc

...snapshot, which includes AuthorizedKeysCommand. The port of ssh-ldap-helper (at http://old.nabble.com/-new--ssh-ldap-helper-td34667413.html) contains all the bits I need, and the individual pieces appear to work once configured: # sudo -u nobody /usr/local/libexec/ssh-ldap-wrapper mwlucas ssh-rsa AAAAB3NzaC1yc... ssh-rsa AAAAB3NzaC1yc2EA... (Two keys come out, with a blank line between them) My sshd_config has: AuthorizedKeysCommand /usr/local/libexec/ssh-ldap-wrapper AuthorizedKeysCommandUser nobody (Yes, a user other than nobody will go into production, but I'm just trying to make the blasted...