Re: PAM and SSH

On Sat, Mar 18, 2006 at 01:17:19PM -0500, Ron Wheeler wrote:
It does not seem to work.
It appears that for sshd, sshusers would have to be their primary group
and it is not.

sshd checks the supplemental group ids by using getgrouplist. Is it
possible that your system doesn't return those (eg if the data source
isn't listed in nsswitch.conf?)

It also appears that the Allow* directives act like seives. You have to
pass all of the specified criteria to get in.
This means they would have be in the right group AND local rather than
OR which is what I need.

Not exactly. Once you have either of AllowUsers or AllowGroups then
the entire list of that type of directive will be checked before any
login not matching at least one rule of that type is denied.

So it's a logical OR within types and a logical AND across types. That's
why I suggested using two AllowGroups directives in my follow-up post.

Darren Tucker (dtucker at
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

Relevant Pages

  • Re: how would openssh react face to an attack ?
    ... >but how would it react face to an attack? ... account after X password failures. ... if the OS doesn't support lockout then sshd doesn't either. ... Good judgement comes with experience. ...
  • Re: telnet tunnelling ssh
    ... >That host has ssh package installed and sshd up and running. ... >(All looks silly but it's the truth) ... >connection already established? ... Good judgement comes with experience. ...
  • Re: AIX 5.3 LDAP PAM PrivilegeSeperation
    ... > If we run sshd in non-privilegeseperation mode, ... > expiry, when a user is REQUIRED to change the password, when a new ... Good judgement comes with experience. ...
  • Re: key_read: missing keytype
    ... the logfiles indicated that my sshd doesn't check this ... uses that directory but OpenSSH doesn't. ... Good judgement comes with experience. ...
  • Re: sshd does not die when client issues control-C or closes
    ... The child processes die, but uClinux port of SSHD appears to be ... Good judgement comes with experience. ...