pam-ussh is a PAM module designed to authenticate users based on the presence of a valid SSH certificate held by their SSH agent. It enables secure authentication, primarily intended for use with sudo, by verifying the user's certificate against a specified Certificate Authority (CA). The module leverages the standard SSH agent to facilitate this process.
This project provides a straightforward mechanism for integrating SSH certificate authentication with PAM. Its design emphasizes simplicity and ease of configuration, making it readily deployable. It supports standard SSH certificate workflows and is compatible with Linux and macOS systems. The use of Go offers performance benefits and cross-platform compatibility.
- Certificate-Based Authentication: Verifies user identity against SSH certificates stored in the agent.
- Sudo Integration: Primarily designed for secure sudo access, enhancing system administration security.
- Configuration Options: Supports customization through
ca_file,authorized_principals, and group membership. - Cross-Platform Support: Compatible with Linux and macOS environments.
- Go Implementation: Provides a performant and portable solution.
The project is relatively mature, with a history of stable releases and recent maintenance activity. Documentation includes usage examples and configuration details. While community support is limited, the project addresses a specific security requirement effectively. The project has a reasonable code coverage.
pam-ussh benefits system administrators seeking to enhance security through SSH certificate authentication. It's ideal for environments where strong authentication is required, particularly for privileged operations such as sudo. By leveraging SSH certificates, it offers a more secure alternative to password-based authentication or traditional key-based authentication methods.