Chapter 9. Authentication in ThinLinc
• Any old public keys added by tl-ldap-certalias are removed from the authorized_keys file and the
keys from the current set of certificates are added.
• The file /etc/passwdaliases is updated with a list of subject names and user id:s, to allow for
login without usernames. See Section 9.5.6 for more information.
Note: It should be noted that any custom entries in ~/.ssh/authorized_keys will be retained, but
custom changes to /etc/passwdaliases will be overwritten each time tl-ldap-certalias is run.
After deployment, tl-ldap-certalias is meant to be run from cron at regular intervals, for example every
15 minutes. This makes sure that the ThinLinc system automatically keeps all user certificates updated.
However, please note that if you’re using certificate validation, downloading and parsing certificate
revocation lists may take a long time (up to 5 minutes each). This is mitigated by caching the data from
the CRL:s, but the first run and whenever the CRL needs to be updated may take a long time. Thus, if
you have certificates from a lot of different certificate authorities, don’t run tl-ldap-certalias too often.
Since the default use of this tool is to be run from cron, the default behaviour is to produces no output
other than error messages. If you want more output from tl-ldap-certalias, see options in Section 9.5.7.1.
Note: The root user must able to write to the users’ home directories for tl-ldap-certalias to be able
to update the ~/.ssh/authorized_keys files.
9.5.7.1. Command line options
tl-ldap-certalias accepts a number of different command line options that affects how the program
interacts with its environment.
-v
--verbose
Turn on program status output to standard output. This is off by default.
-d
--debug
Turn on extra debugging putput to standard output. This is off by default.
-s
--simulate
Dry run mode. Specifying this option tells tl-ldap-certalias to avoid writing any changes to disk.
This is off by default.
-h
--help
Show usage information and exit.
105
Comentarios a estos manuales