Re: SSH pubkey or password based on user group

Nikos Nikoleris wrote:
Hi,

What I was trying to do is not to allow users that are in root group to
login using ssh in our server without having their public key while
every other user can choose whether they will login using their password
or their public key.
I was searching through pam modules without success if there was a way
of doing this through pam but I couldn't find any module that will have
my job done. Does anyone have any clue if there is a way of doing this

hello.

I'm posting in case there is someone else who wants to do that.

finally, we did it ... ;-)

/etc/pam.d/ssh:
auth required pam_listfile.so item=group sense=deny
file=/etc/ssh/sshd.deny onerr=succeed

/etc/ssh/sshd.deny:
pubkeyssh

so any member of pubkeyssh group is allowed to login only with a pubkey.

I 'm sure there is an easier way to do it but it's more about pam than ssh.

cheers,

--
Anastassios Nanos
<ananos@xxxxxxxxxxx>

1024D/CCCE759D 2007/04/29 Anastassios Nanos <ananos@xxxxxxxxxxx>
Key fingerprint = 60EC 7B9E CD11 9AB2 C3CE B694 08D6 F033 CCCE 759D
.

Relevant Pages

  • Re: SSH login automation, get stuck at the last step.
    ... The ssh server that I am copying the public key to is not a typical ... The user "root" to login this box can not access the ... puts stderr "EXP username requested and sent " ...
    (comp.lang.tcl)
  • SUMMARY: how to set correct path?
    ... ven if we login with ssh. ... For BASH login shell, place the system wide ENV variables, such as PATH, ... You can set Use_login in the sshd_config to yes and restart sshd. ...
    (SunManagers)
  • Re: ssh brute force attacks
    ... What you are most likely seeing are SSH worms on hacked PCs that scan ... -- use a separate username/password for SSH access, ... -- enforce more complex usernames & passwords for all users on the server ... Instead require the user to login as a non-root user first, ...
    (comp.os.linux.misc)
  • Re: Authentication with SSH using public keys
    ... I use ssh to login remotely. ... there looks odd, or different, from other remote hosts I do this on. ... The permissions on the machine where it doesn't work: ...
    (freebsd-questions)
  • Public Authentication Problem on Batch Job using SCP2 when SSH Client Reboot
    ... to a SSH server, HOST2. ... for secure ftp login. ... The login ID is a local user account ... we found that scp2 run failed every time the SSH client ...
    (comp.security.ssh)