passwordless ssh authentication using active directory

Question

Our current infrastructure uses ssh keys for passwordless login to our Linux servers. As our infrastructure grows, managing these authorised keys is getting harder.

As we also have an Active Directory (AD) server, I would like to authenticate the users over ssh using this mechanism, but maintain the passwordless nature of ssh keys.

Is it possible to authenticate the users over ssh without password, using some AD mechanism?

Answer 1

Option 1

This is a good article explaining how to do this. Storing SSH keys in Active Directory for easy deployment

Basically, it will allow people to post their public keys to your Active Directory and then you can set up a cron script on your servers to fetch a copy of the public keys every 5 minutes or so.

Option 2

You could also use a file server that has all your keys and get each server to fetch from there using a cron script. Obviously, you need a way to verify each key's authenticity especially if you are using FTP or some other insecure protocol. This could be achieved using GPG. You could have a company master GPG key that signs all the employee keys.

Personally, I like option 2 the best because I think it is more secure, but either method should work. Hope this helps!