Bug 204764

Description of problem:

This is a feature enhancement request (FutureFeature); I have submitted an enhancement request to 
Red Hat Technical Support (request #991478) asking that the OpenSSH LDAP Public Key patch (http://
www.opendarwin.org/en/projects/openssh-lpk/) be added to the openssh package that ships with Red 
Hat Enterprise Linux.  I was told that this would be unlikely unless the patch were to be accepted by the 
OpenSSH project or by Fedora; as such, I request that you review the patch and include it in Fedora 
Core.

The LDAP Public Key patch allows sshd to query a LDAP server to find a user's public key.  If none is 
found or if there is a problem connecting to the LDAP server, sshd fails through to the traditional 
methods of searching for a public key (~/.ssh/authorized_keys etc.)  This functionality enables 
administrators to centralize the management of public keys; for example, if a user should be given 
access to several machines but denied access to others, the admin simply has to add that user's UID to 
the appropriate groups within the LDAP tree, rather than needing to touch the user's home directory on 
each machine.  In an environment with shared home directories, implementing this sort of fine-grained 
control could be very difficult; the LDAP Public Key patch makes it easier to do so.

While this sort of functionality may not be of interest to the casual user, it is a helpful tool for 
administrators of larger networks (especially ones where an LDAP infrastructure has already been 
deployed).  As such, it seems appropriate to add this functionality to Red Hat Enterprise Linux.

For an example of the OpenSSH LDAP Public Key patch in production use, look at the Gentoo 
distribution (http://www.gentoo.org).  A possible point of contact is Andrea Barisani 
(lcars).

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info: