As far as implementing it yourself you could write your own ssh authorized keys script to lookup the status of the user in LDAP before retrieving their key. If they are locked just exit and don't return their key.
The script is defined in /etc/ssh/sshd_conf as AuthorizedKeysCommand and typically points to /usr/bin/sss_ssh_authorizedkeys. sshd calls this script on login and passes it the username at the first argument. /usr/bin/sss_ssh_authorizedkeys <username> So you could wrap this script inside your own with an added ldap search to first check if the user is locked.
_______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected]/message/KVYRVLWEI6TVKDUUDQKJINN3BQTS3AXN/
