topic SSH and LDAP in Operating System - HP-UX

SSH and LDAP

Massimiliano Adamo — Sun, 11 Dec 2005 22:29:53 GMT

I am going to setup and LDAP server for authentication and sudo administration. I have seen a patch for OpenSSH allowing openssh to work with ldap (it's installed by default on gentoo linux).
At same time I have seen that hp-ux secure shell is based on openssh. Now I am trying to compile openssh with these extension, but I have no success in this operations.
The last error that I get is this one:
/usr/ccs/bin/ld: Unsatisfied symbols:
ber_sockbuf_io_tcp (first referenced in /usr/local/lib/libldap.a(open.o)) (data)
ber_free (first referenced in /usr/local/lib/libldap.a(result.o)) (code)
ber_memvfree (first referenced in /usr/local/lib/libldap.a(getdn.o)) (code)
ber_memrealloc_x (first referenced in /usr/local/lib/libldap.a(controls.o)) (code)
.... and so on.

Do you have idea?
--
Thanks
Massimiliano

Do you have an

Re: SSH and LDAP

Arunvijai_4 — Sun, 11 Dec 2005 23:46:26 GMT

Hello,

Try downloading and installing Internet Express OpenLDAP from http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

Also, you can install and use HP's Secure Shell from http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=T1471AA.

-Arun

Re: SSH and LDAP

Massimiliano Adamo — Mon, 12 Dec 2005 00:34:17 GMT

Hello Arun.

first of all thanks for your help.
I was using openldap and openssl fro hp-ux taken from another website (porting for hpux)

I still didn't fix the the problem using the versions provided by HP.

Regarding the version of SSH provided by HP I don't think it contains the same kind of patch that I probably need and that I have on Gentoo.
I can see the difference between the version that I have on gentoo and on hp-ux.
First the man page on gentoo speaks about LpkServer, LpkUserDN, Lpk.... (yes the patch also patches tha man page of course :P).
Second sshd_config on gentoo contains commented rows regarding this lpk.
In other words we are not speaking about the same thing :-) Furthermore, LDAP+SSH seems to be totally undocumented on HP-UX.
mmhh... hope nobody answers saying that's not much used, and for that reason is not supported by HP ;-) I have seen similar answers when people asked about loop devices and pseudo filesystems ;)
--
Massimiliano

Re: SSH and LDAP

Armin Kunaschik — Wed, 14 Dec 2005 06:18:09 GMT

HP's OpenSSH is able to authenticate against an LDAP directory via PAM.
This seems to be different compared to your Gentoo SSH.
I think there is also a PAM_LDAP for Linux.
I'd prefer this kind of LDAP integration because is independent from any application and operation system.

If you like to continue this way check the prerequisites of the ldap patch e.g. (Open)LDAP(?) version and the consistency (same version!) of the header and library files.
Maybe there are also compiler issues (gcc or HP-ANSI-cc)?

My 2 cents,
Armin

PS: Assign points if you find answers useful!

Re: SSH and LDAP

Massimiliano Adamo — Wed, 14 Dec 2005 08:12:14 GMT

Hi armin.

thanks for the answer.
Anywa, I know hp secure sh works with pam and ldap.
Gentoo patch (provided by openssh team) is something different: it's something used to distribute ssh keys from an LDAP server.
To be much clear as possible: using an LpK server (Ldap Public Key server) you don't need to store they keys on each single machine in ~/.ssh/blabla .... but you'll get it from the LpK server. As I have 700 server this is quit important for me, and this is what I am looking for.
Regarding authentication, of course it works with pam (but that wasn't my question), and I think everybody knows.

Once I compile ssh with this patch I'll create the depot file and distritubte on all servers.

If you want point from me I'll be happy to help you but you must answer my question, not another :-))

Cheers
Massimiliano

Re: SSH and LDAP

Armin Kunaschik — Wed, 14 Dec 2005 13:51:27 GMT

You define how useful you find answers. That's OK.
I didn't ask you to give 10 points to me, it's up to you!

But you should accept how things work in this forum! You did not give ANY points to anybody (yet hopefully)!
There are people around who simply don't give answers if they can't earn points.
You can expect less answers if you don't follow that rules.

You have to decide on your own!
Armin

PS: Please assign 0 points to that message :-)

Re: SSH and LDAP

Massimiliano Adamo — Thu, 15 Dec 2005 08:02:14 GMT

gave you 2 points, and that was too much to hear things that I already knew :))

cheers
Massimiliaon