Re: Allowing user w/out local account to log in

On 10 Apr, 22:56, ltdill...@xxxxxxxxx wrote:
Greetings,

This is probably an easy question for you experts, but I'm not one of
you!

We want to allow any user to remotely SSH into our server. They won't
have an account on the server. We plan on using PAM to "redirect" all
SSH requests to a particular command-line application. The username
will be passed along to this application which will verify if it's OK
to proceed.

I have a bare-bones PAM module that supports all four services; right
now it gives success to all of them. However, I see SSH failing out
when an unknown user attempts to connect, even though my PAM module's
'pam_sm_authenticate' gets called. Here's the syslog output  (my
module is outputting the last line):

Apr  9 21:28:23 nemi-011 sshd[1467]: WARNING: /etc/ssh/moduli does not
exist, using fixed modulus
Apr  9 21:28:23 nemi-011 sshd[1467]: Invalid user bob from xx.xx.xx.xx
Apr  9 21:28:23 nemi-011 sshd[1467]: pam_sm_authenticate

So how would one allow a user that did not have a local account to get
access?

Thank you.

Why aren't you using multiple SSH keys for the same user account on
the server? And if you only want file sharing, not shell access, I'd
suggest using WebDAV over HTTPS instead. OpenSSH, at least, does not
have good chroot capability built in to isolate hte users from the
operating system.
.

Relevant Pages

  • Re: How restrict network login on AIX for everything BUT SSH? (RLOGIN=FALSE & loginrestrictions
    ... Unfortunately I WANT to disable telnet, rsh, rlogin etc for an account, BUT keep SSH enabled. ... However in Aix v5.3 full pam support was added, and our LAM module broke and we have been unable to figure out how to get it working again. ...
    (comp.security.ssh)
  • Re: How restrict network login on AIX for everything BUT SSH? (RLOGIN=FALSE & loginrestrictions
    ... Unfortunately I WANT to disable telnet, rsh, rlogin etc for an account, ... BUT keep SSH enabled. ... However in Aix v5.3 full ... pam support was added, and our LAM module broke and we have been unable ...
    (comp.security.ssh)
  • Thanks Sun, for PAM
    ... It's the account management ... facility of PAM that has been the greatest benefit to us. ... Our pam_class_auth module restricts access to users having either the ... All that's necessary is to ensure that all server ...
    (comp.unix.solaris)
  • Re: Just copy the .ssh directory?
    ... By just copying the .ssh directory, ... the second account, and append your new public key to that authized_keys ... file on your server. ... > authentication to a server running linux, but I have a strange problem ...
    (comp.security.ssh)
  • Re: need remedial iptables info
    ... >> We recently had a server root level hacked. ... can I still "su -" from another account OK? ... > via ssh. ...
    (comp.os.linux.networking)