Home / server / Questions / 324227
Accepted
Peter Mounce
Asked: 2011-10-25 03:44:22 +0800 CST

Possible to enable ssh passwordless authentication via Windows Active Directory?

  • 772

Is it possible to set up ssh and Active Directory (Win2008r2 flavour) such that domain-users can access *nix and ssh-servers-running-on-Windows-servers without needing to type their password?

If so, how?

I've found some documentation that suggests that it (or something like it) is possible by modifying the AD schema to make room for a public-key.

However, most of the concepts themselves are new to me, because really, I'm a developer masquerading as a sysadmin in a dev-ops team.

Context: we have some Windows boxes, and some *nix boxes, and we want to run some remote-admin automation on both sets of them in a continuous-deployment type scenario as well as an ad-hoc maintenance-from-a-central-place type scenario.

active-directory authentication ssh single-sign-on public-key

3 Answers

  1. Best Answer

    I have attempted the exact same thing as you have, specifically attempting to manage Linux and Windows with the same toolset, and have found nothing but pain and frustration. The two are so very different in setup, outlook, and design assumptions that tools that work well on one (SSH, PowerShell) are ugly, fragile hacks on the other platform (yes, there exists a PowerShell for Linux, written in Mono). The fragility has pushed us to use two separate deployment systems for our Windows and Linux systems. I don't know of any existing tool that can do both, though I know of a couple who are adamantly trying (both Chef and Puppet is reported to be working on such a Grand Unified Management Framework, Chef has delivered).

    My advise, especially since you seem to be a Linux-first organization, is see what kind of hooks you can find for accessing the Windows Remote Management framework ("winrm" is the keyword). It's kerberized SOAP calls over HTTP at the base, so is actually a lot easier on the remote system than installing SSH servers on your Windows machines. Ruby has a gem that'll do it. WinRM is interesting because it is Microsoft's designated "run commands on remote machines" framework, which is what you're attempting to use SSH for, and theoretically offers either cmd.exe or PowerShell as a command-interpreter.

    • 4

  2. I have a setup that indirectly achieves the same purpose for some of my systems. SSH access to the target systems is via public/private key only. The keys are stored on a network share which is accessible only to those permitted to have access. Kind of simple and crude but quite effective. Of course there's nothing to prevent an authorised user from copying the key(s) but only trusted users have access anyway.

    • 0

  3. Another way of doing this is the way I am doing it which is with a combination of samba with winbind to add the system to aduc and use kerberos for single sign on.I have several guides if you are I interested.

    • 0