diff --git a/lam/docs/manual-sources/chapter-modules.xml b/lam/docs/manual-sources/chapter-modules.xml
index abb36e83..3801db25 100644
--- a/lam/docs/manual-sources/chapter-modules.xml
+++ b/lam/docs/manual-sources/chapter-modules.xml
@@ -1955,8 +1955,14 @@
You can manage your public keys for SSH in LAM if you installed
the LPK patch for
- SSH. Activate the "SSH public key" module for users in the
- server profile and you can add keys to your user entries.
+ SSH or setup AuthorizedKeysCommand (see below).
+
+ Activate the "SSH public key" module for users in the server
+ profile and you can add keys to your user entries.
+
+
+
+
@@ -1965,6 +1971,30 @@
+
+ Example for
+ AuthorizedKeysCommand
+
+ This will dynamically get the public key from LDAP. In this case
+ there is no need to patch SSH sources.
+
+ Create the authentication script in e.g.
+ /usr/bin/ldapAuthSSH.sh
+
+
+#!/bin/bash
+uid=$1
+server=ldap.domain.com
+baseDN=ou=people,dc=example,dc=com
+port=389
+ldapsearch -x -h $server -p $port -b $baseDN -s sub "(&(objectclass=posixAccount)(uid=$uid))" | sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'
+
+
+
+ Now setup your sshd_config
+
+ AuthorizedKeysCommand /usr/bin/ldapAuthSSH.sh
+AuthorizedKeysCommandUser root
diff --git a/lam/docs/manual-sources/images/ldapPublicKey.png b/lam/docs/manual-sources/images/ldapPublicKey.png
index b2b885e7..3d927a68 100644
Binary files a/lam/docs/manual-sources/images/ldapPublicKey.png and b/lam/docs/manual-sources/images/ldapPublicKey.png differ
diff --git a/lam/docs/manual-sources/images/ldapPublicKey2.png b/lam/docs/manual-sources/images/ldapPublicKey2.png
new file mode 100644
index 00000000..9878d7e1
Binary files /dev/null and b/lam/docs/manual-sources/images/ldapPublicKey2.png differ