Skip to content

v1.0.0

Choose a tag to compare

View all tags
@wmantly wmantly released this 30 Jul 13:45
· 6 commits to master since this release
v1.0.0
f6cf923
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First tagged release. Adds a Docker test fixture (Dockerfile + entrypoint.sh: Ubuntu 22.04 + sssd + sshd, no systemd required) for exercising this script's actual SSSD+AuthorizedKeysCommand flow, which surfaced and fixed three real bugs:

  • sssd.conf.mo used ldap_bind_dn/ldap_bind_pw, which aren't real SSSD options -- corrected to ldap_default_bind_dn / ldap_default_authtok(_type).
  • sssd.conf.mo had no explicit services = list, so SSSD started only its backend, never the nss/pam responders -- getent passwd <ldap-user> silently failed even with the domain reachable.
  • ldap-ssh-key.sh's memberof filter was missing the cn= prefix on the group name, so the AuthorizedKeysCommand script always returned zero keys for a correctly-provisioned user -- no error, just silently nothing.

Also relaxed ldap_tls_reqcert to never for self-signed dev certs, and commented out ldap_sudo_search_filter (not a real option on SSSD 2.6.3).

Verified end-to-end: real SSH login through a jump-host's uid_-_target grammar, live key injection into LDAP, and the downstream host serving that key via AuthorizedKeysCommand -- both via the SSH CLI and WinSCP.

Assets 2
Loading