1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
|
#! /usr/bin/perl
# This file is part of pam-modules.
# Copyright (C) 2014 Sergey Poznyakoff
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 3, or (at your option)
# any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program. If not, see <http://www.gnu.org/licenses/>.
use strict;
use Net::LDAP;
=head1 NAME
ldappubkey - get user public ssh keys from the LDAP database
=head1 SYNOPSIS
B<ldappubkey> I<LOGIN>
=head1 DESCRIPTION
Produces on the standard output public ssh keys for the user I<LOGIN>, each
on a separate line. The program is designed for use with B<sshd>(8) version
6.x or higher. Public keys are obtained from a LDAP database. The
configuration is looked up in the following files: B</etc/ldap.conf>,
B</etc/ldap/ldap.conf> and B</etc/openldap/ldap.conf>. These files are
tried in this order and the first one of them that exists is read.
The following configuration statements are used (all keywords are
case-insensitive):
=over 4
=item B<uri> B<ldap[si]://>[I<name>[:I<port>]] ...>
Specifies the URI of the LDAP server (or servers) to connect to. The default
is B<ldap://127.0.0.1>.
=item B<base> I<DN>
Specifies the default base DN to use when performing ldap operations.
The base must be specified as a Distinguished Name in LDAP format.
=item B<binddn> I<DN>
Specifies the default bind DN to use.
=item B<bindpw> I<PASS>
Specifies the password to use with B<binddn>.
=item B<uid> I<ATTR>
Name of the attribute to use instead of B<uid>. The LDAP record is searched
using the filter B<(&(objectClass=posixAccount)(I<ATTR>=I<LOGIN>))>.
=item B<publickeyattribute> I<ATTR>
Name of the attribute which holds the public key. Default is B<grayPublicKey>.
=back
=head1 OPTIONS
=over 4
=item B<-h>
Show program usage.
=item B<--help>
Show detailed help page.
=back
=head1 SEE ALSO
B<sshd>(8), B<sshd_config>(5), B<ldap.conf>(5).
=head1 BUGS
LDAP filter string is hardcoded.
=head1 AUTHOR
Sergey Poznyakoff <gray@gnu.org>
=cut
# ###################################
# Configuration file handling
# ###################################
my %config = ('uri' => 'ldap://127.0.0.1', 'uid' => 'uid',
'publickeyattribute' => 'grayPublicKey');
sub read_config_file($) {
my $config_file = shift;
my $file;
my $line = 0;
open($file, "<", $config_file) or die("cannot open $config_file: $!");
while (<$file>) {
++$line;
chomp;
s/^\s+//;
s/\s+$//;
s/#.*//;
next if ($_ eq "");
my @kwp = split(/\s*\s+\s*/, $_, 2);
$config{lc($kwp[0])} = $kwp[1];
}
close($file);
}
sub assert {
my $mesg = shift;
my $action = shift;
die("An error occurred $action: ".$mesg->error) if ($mesg->code);
return $mesg;
}
# ###################################
# MAIN
# ###################################
die "bad number of arguments; try perldoc $0 for more info"
unless ($#ARGV == 0);
## Read configuration
foreach my $file ("/etc/ldap.conf", "/etc/ldap/ldap.conf",
"/etc/openldap/ldap.conf") {
if (-e $file) {
read_config_file($file);
last;
}
}
my $ldap = Net::LDAP->new($config{'uri'})
or die("Unable to connect to LDAP server $config{'uri'}: $!");
my @bindargs = ();
if (defined($config{'binddn'})) {
push(@bindargs, $config{'binddn'});
push(@bindargs, password => $config{'bindpw'})
if defined($config{'bindpw'});
}
assert($ldap->bind(@bindargs), "binding to the server");
my $attr = $config{'publickeyattribute'};
my $filter = "(&(objectClass=posixAccount)($config{'uid'}=$ARGV[0]))";
my $res = assert($ldap->search(base => $config{'base'},
filter => $filter,
attr => [ $attr ] ),
"searching for $filter in $config{'base'}");
foreach my $entry ($res->entry(0)) {
my $keyref = $entry->get_value($attr, asref => 1);
for (@{$keyref}) {
print "$_\n";
}
}
# END
|
