<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 12/22/2014 08:40 PM, Prashant Bapat
wrote:<br>
</div>
<blockquote
cite="mid:CAN9aUriLTJAHxKWfjquA3pQq9pn4Qb=LYvEFLW4oknvTs5UD4Q@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_default" style="font-family:trebuchet
ms,sans-serif">Hi,<br>
<br>
</div>
<div class="gmail_default" style="font-family:trebuchet
ms,sans-serif">We are planning to roll out FreeIPA for our AWS
infrastructure to be the central authentication service.
Initially we plan to use the SSH publi keys, user and group
management by FreeIPA. We are looking at rolling out the SSS
on clients a little later. <br>
<br>
</div>
<div class="gmail_default" style="font-family:trebuchet
ms,sans-serif">Two questions. <br>
<br>
</div>
<div class="gmail_default" style="font-family:trebuchet
ms,sans-serif">1. We need to be able to ensure that a user is
limited only 2-3 SSH keys. <br>
</div>
</div>
</blockquote>
SSH keys are a string attribute with a validator. In order to limit
the number, you would need to modify the plugin here:<br>
<br>
<br>
<a class="moz-txt-link-freetext" href="https://git.fedorahosted.org/cgit/freeipa.git/tree/ipalib/util.py#n310">https://git.fedorahosted.org/cgit/freeipa.git/tree/ipalib/util.py#n310</a><br>
<br>
<br>
<br>
<blockquote
cite="mid:CAN9aUriLTJAHxKWfjquA3pQq9pn4Qb=LYvEFLW4oknvTs5UD4Q@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_default" style="font-family:trebuchet
ms,sans-serif">2. We need some way of forcing these key
rotation once in say 90 days. <br>
<br>
</div>
<div class="gmail_default" style="font-family:trebuchet
ms,sans-serif">In our existing setup we use a SSH CA based
authentication. It has its own issues. But the rotation is
handled by cert expiry every 90 days. <br>
</div>
</div>
</blockquote>
<br>
This is going to be harder. With password you can validate on
login, but there is caching involved with the public key, and I
think you would need to take that into account to force
invalidation. This is why certs are probably a better idea.<br>
<br>
Assuming you can flush the public keys fairly regularly, you would
want to put the expiration checking on the accessor for the key.
This is a direct ldap fetch and not managed by the IPA plugins.<br>
<br>
<blockquote
cite="mid:CAN9aUriLTJAHxKWfjquA3pQq9pn4Qb=LYvEFLW4oknvTs5UD4Q@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_default" style="font-family:trebuchet
ms,sans-serif"><br>
</div>
<div class="gmail_default" style="font-family:trebuchet
ms,sans-serif">Any suggestions/help would be appreciated. <br>
<br>
Thanks in advance. <br>
<br>
</div>
<div class="gmail_default" style="font-family:trebuchet
ms,sans-serif">--Prashant<br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-devel@redhat.com">Freeipa-devel@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-devel">https://www.redhat.com/mailman/listinfo/freeipa-devel</a></pre>
</blockquote>
<br>
</body>
</html>