SSH Certificate PAM Module: pam-ussh
SSH Certificate PAM Module This is a pam module that will authenticate a user based on them having an ssh certificate in their ssh-agent signed by a specified ssh CA. This is meant for things that require authentication post-login, usually on a remote system. So you ssh to machineA and sshd authenticates you (probably using your ssh cert, because if you’re using it for this, you’re probably using it for sshd as well). At that point when you want to run a command that requires authentication (eg. sudo), you can use pam-ussh for authentication. Works on linux and osx. BSD doesn’t work because go doesn’t (yet) support buildmode=c-shared on bsd. Building: clone the repo and run ‘make’ $ git clone github.com/uber/pam-ussh ... $ make mkdir -p /home/pmoody/tmp/pam-ussh/.go/src GOPATH=/home/pmoody/tmp/pam-ussh/.go go get golang.org/x/crypto/ssh GOPATH=/home/pmoody/tmp/pam-ussh/.go go get golang.org/x/crypto/ssh/agent GOPATH=/h...