Chapter 9. Authentication in ThinLinc
The second line, starting with "ssh-rsa", is the one needed for SSH version 2 authentication. For
instructions on how to associate this key with a user, see Section 9.4.
9.5.5. Client Configuration
The ThinLinc client requires no special configuration to use the smart card.
9.5.6. Automatic Connection
The client is able to automatically connect to the server when a smart card is inserted (see Section 7.4.5).
It does, however, require that the user is able to log in using the subject name on the card. As that is
rarely a valid user name, ThinLinc ships with a special NSS module, called nss-passwdaliases, that
enables alternate names for users.
The module is configured by editing the file /etc/passwdaliases. The file is a colon-delimited table
of alternate names and their corresponding user ids. Example:
givenname=John,sn=Doe,c=us:572
To activate the nss-passwdaliases module, it must be added to the list of NSS modules for the passwd
database. This is specified in the file /etc/nsswitch.conf. For example, replace the following line:
passwd: files ldap
with this line:
passwd: files ldap passwdaliases
9.5.7. LDAP Automatic Update (tl-ldap-certalias)
ThinLinc includes the tool tl-ldap-certalias that can automatically update the local databases needed for
smart card public key authentication, provided the system uses the OpenSSH server (or any SSH server
that uses a compatible format and location for authorized public keys) and standards compliant LDAP
servers where users and certificates are stored.
The tl-ldap-certalias command can also perform validation of certificates it finds in LDAP databases.
Read more about this in Section 9.5.7.3.
• On invocation, a list of all users and matching certificates is gathered. How is determined by the
certificate_user_match configuration variable. If allow_invalid_certificates is no, only
matching valid certificates will be gathered.
• The user’s home directory, as well as the .ssh directory, are created if they are required and do not
already exist. tl-ldap-certalias reuses the /vsmagent/make_homedir_mode configuration variable
from vsmagent for determining the default permissions of newly created home directories.
104
Kommentare zu diesen Handbüchern