Admin auth per SSH key and LDAP

[ede_pfau]

Hello fellows,

for simplicity, I often use my private SSH key to log in into my local admin account on various FGTs (I mean, CLI access via SSH). Now, if instead of a local admin account I use a wildcard admin account against LDAP/MS AD in the background, I cannot use this anymore.

Any ideas how to work around this?

[xsilver_FTNT]

Hi Ede,

how do you expect it to work ? Like one public key for everyone eligible to login through LDAP ?

In this type of remote users is password, and so I believe key as well, used as fallback option if remote server is not reachable or do not respond to authentication attempts.

Workaround might be in the way that remote server will read and use provided password as key.

[ede_pfau]

You're right, "how do you expect it to work?" Seems you can't have the pudding and eat it.

[xsilver_FTNT]

yes.

Seems to me that all the modern tech is about the same ... options are "cheap", "fast" and "reliable/robust", and you can choose two but newer be able to get all three in one product.

[emnoc]

I'm sure you can do this in LDAP  but it take works maybe a fork of  RADIUS or  TACAS.

I would look at . jirutka/ssh-ldap-pubkey

You will need custom attributes and then you can deploy what you want. Certificate would be much much much better imho YMMV

Ken Felix

[ede_pfau]

Thanks Ken, I will look into certs then.