<div dir="ltr">I already ran that command to configure centos host as client. I used 'ipa-client-install --mkhomedir --no-ntp'.<div>Now my IPA users are able to SSH to that box, using passwords set in IPA.<br>Next I would like them to SSH using keys.</div>
<div>When I looked through the document for more info, I found this line - '<span style="font-size:13px;color:rgb(0,0,0);font-family:arial,sans-serif">After uploading the user keys, configure </span><span style="font-size:13px;color:rgb(0,0,0);font-family:arial,sans-serif">SSSD</span><span style="font-size:13px;color:rgb(0,0,0);font-family:arial,sans-serif"> to use </span><span style="font-size:13px;color:rgb(0,0,0);font-family:arial,sans-serif">FreeIPA</span><span style="font-size:13px;color:rgb(0,0,0);font-family:arial,sans-serif"> as one of its identity domains and set up </span><span style="font-size:13px;color:rgb(0,0,0);font-family:arial,sans-serif">OpenSSH</span><span style="font-size:13px;color:rgb(0,0,0);font-family:arial,sans-serif"> to use the </span><span style="font-size:13px;color:rgb(0,0,0);font-family:arial,sans-serif">SSSD</span><span style="font-size:13px;color:rgb(0,0,0);font-family:arial,sans-serif"> tooling for managing user keys.</span>'<br>
I was hoping someone can shed light on how to do that. Or if someone has configured their IPA clients to enable key-based SSH to clients, can they please share their experience.<br><br>Thanks.</div><div><div><br></div></div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Apr 17, 2014 at 5:48 PM, Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div><div class="h5">
<div>On 04/17/2014 02:42 PM, quest monger
wrote:<br>
</div>
</div></div><blockquote type="cite"><div><div class="h5">
<div dir="ltr">
<div>I have setup <span>freeipa</span> server, and
added a <span>centos</span> client that my <span>ipa</span> users can now ssh too by using the <span>freeipa</span> account credentials.</div>
<div>Now, i would like my users to be able to ssh to this <span>centos</span> client using keys.</div>
<div>I read this - <a href="http://docs" target="_blank">http://docs</a>.<span>fedoraproject</span>.org/en-US/Fedora/18/html/<span>FreeIPA</span>_Guide/user-keys.html</div>
<div>I generated the key-pair, and added the public key to user
account in <span>freeipa</span> web console.</div>
<div><br>
</div>
<div> Towards the end of that document, i found this - </div>
"After uploading the user keys, configure <span>SSSD</span>
to use <span>FreeIPA</span> as one of its identity
domains and set up <span>OpenSSH</span> to use the <span>SSSD</span> tooling for managing user keys."<br>
<div>No instructions in the document on how to do this. <br>
</div>
<div><br>
</div>
<div>Do i need to do anything on the <span>centos</span>
client-side to make this work?<br>
</div>
<div>
<br>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
</div></div><pre>_______________________________________________
Freeipa-users mailing list
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
yum install ipa-client<br>
<br>
then run ipa-client-install with arguments you need (see man pages
or manual) which will configure your client. Depending on the
version it will also be able to configure SSH integration.<br>
<br>
See man on ipa-client-install <br><span class="HOEnZb"><font color="#888888">
<br>
<pre cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</font></span></div>
<br>_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br></blockquote></div><br></div>