[SSSD] ssh client correctly denied access but sees "connection closed by IP"

Simo Sorce simo at redhat.com
Mon Aug 19 17:57:34 UTC 2013


On Mon, 2013-08-19 at 13:48 -0400, Sophit4 wrote:
> Thank you for your response and I accept your explanation.
> 
> Here's why I'm concerned: this particular internal site has SSH client
> users who will be confused by an apparent successful authentication
> (password accepted without feedback) followed by an abrupt,
> uninformative disconnect.
> 
> 
> FYI, with the pam_ldap-185-11.el6.x86_64 based configured with the
> following in /etc/pam_ldap.conf on RHEL 6.4
> 
> pam_groupdn cn=GoodUsers,ou=x,ou=y,o=z
> 
> 
> 
> and the same sshd package, I get the following when the test group
> isn't available in the LDAP tree:
> 
> [test-client Desktop]$ ssh test-server
> You must be a member of cn=GoodUsers,ou=x,ou=y,o=z to login.
> Connection closed by 111.222.123.45
> [test-client Desktop]$ 

Ok it seem like a message may be returned by pam, can you open a RFE(*)
ticket to support this in pam_sss ? If anything can be doen that's where
we can do it.
> 
> But when /etc/security/access.conf is configured with precedence
> in /etc/pam.d/ files, the disconnect is also abrupt like SSS.
> 
I guess pam_access is not returning messages either.

Simo.

(*) Request For Enhancement
> 
> 
> On Mon, Aug 19, 2013 at 8:23 AM, Simo Sorce <simo at redhat.com> wrote:
>         On Thu, 2013-08-15 at 12:06 -0400, Sophit4 wrote:
>         > SSH Server is running on a RHEL 6.4 system with version
>         > sssd-1.9.2-82.7.el6_4.x86_64.
>         >
>         > I'm using access_provider = ldap in sssd.conf and
>         ldap_access_filter =
>         > memberOf=cn=GoodUsers,ou=x,ou=y,o=z
>         >
>         >
>         > This is working as intended but remote ssh users not in
>         group
>         > GoodUsers are simply disconnected with no error message
>         after
>         > successfully authenticating via authorized_keys or LDAP
>         password.
>         >
>         >
>         > Is there a way to better inform the end user the general
>         reason for
>         > the disconnect?
>         
>         
>         
>         I do not think SSH will allow you to do that. The author sees
>         dropping
>         any further communication as soon as the user is denied as a
>         security
>         feature I believe.
>         
>         They do the same on password changes.
>         
>         Simo.
>         >
>         > Current behavior:
>         >
>         >
>         > [usr1 at test-client Desktop]$ ssh test-server
>         > Connection closed by 192.168.1.22
>         >
>         > [root at test-server ~]# tail -1 /var/log/secure
>         >
>         > Aug 15 11:40:20 test-server sshd[5562]: fatal: Access denied
>         for user
>         > usr1 by PAM account configuration
>         >
>         >
>         >
>         > Thanks in advance.
>         >
>         
>         > _______________________________________________
>         > sssd-devel mailing list
>         > sssd-devel at lists.fedorahosted.org
>         > https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
>         
>         
>         --
>         Simo Sorce * Red Hat, Inc * New York
>         
>         _______________________________________________
>         sssd-devel mailing list
>         sssd-devel at lists.fedorahosted.org
>         https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list