APPLICATION NOTE

Secure, Active Directory-Based Single Sign-On with OpenSSH and Centrify

Using Centrify DirectControl and the DirectControl-enabled version of OpenSSH with Red Hat, Solaris, AIX, HP-UX and other non-Windows systems

SSH has become the defacto standard for administrators and users to securely access remote UNIX systems. The combination of the latest versions of OpenSSH supporting Kerberized connections, along with DirectControl's ability to directly integrate UNIX and Linux computers with Active Directory's Kerberos infrastructure, provides the administrator with the ideal environment for secured single sign-on. Users logging in from Windows computers will be able to securely access remote UNIX computers using their Active Directory credentials to automatically log in to the UNIX or Linux computer.

Centrify provides a DirectControl-enabled version of OpenSSH free of charge to help you be more productive and to accelerate your deployment. Customers and those evaluating DirectControl can download it from the Centrify Download Center. See below for more insight into how OpenSSH works and what you can do with it.

Centrify's unique Support for Open Source Software plan provides the same benefits as product support, including guaranteed service levels and other benefits.

Learn More About the DirectControl-Enabled OpenSSH

While many UNIX systems may have an sshd server installed, most will be older implementations of the sshd server that do not support Kerberos. Centrify provides a compiled version of the latest OpenSSH distribution to make it easier for you to install and use SSH with DirectControl for secured authentication via Kerberos to Active Directory.

Centrify has compiled the standard OpenSSH distribution unmodified, but in the compile process we linked OpenSSH with the DirectControl Kerberos libraries to ensure that single sign-on works seamlessly as expected in an Active Directory environment. This provides several advantages, including:

The OpenSSH client and server are preconfigured  to automatically support PAM and Kerberos.

There is no need for DNS-to-realm mapping  because DirectControl knows the relationship between hosts and their SPNs.

There is no need for a .k5login file in the user's home directory since DirectControl can automatically map the UPN (User Principal Name) in the Kerberos ticket to the UNIX profile for the Active Directory username presented in the ticket.

DirectControl will accept connections to any of the computer's valid hostnames, either fully qualified or not, because all combinations are registered with Active Directory. This further reduces the dependency on accurate DNS entries to enable Kerberos to operate properly.

The installation process automatically updates the $PATH environment by adding /usr/share/centrifydc/bin for all users and /usr/share/centrifydc/sbin for administrators and super users, making direct access to OpenSSH possible.

Supported Platforms