[SSSD] ssh client correctly denied access but sees "connection closed by IP"

Jakub Hrozek jhrozek at redhat.com
Mon Aug 19 17:58:14 UTC 2013


On Mon, Aug 19, 2013 at 01:51:46PM -0400, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 08/19/2013 01:48 PM, Sophit4 wrote:
> > Thank you for your response and I accept your explanation.
> > 
> > Here's why I'm concerned: this particular internal site has SSH
> > client users who will be confused by an apparent successful
> > authentication (password accepted without feedback) followed by an
> > abrupt, uninformative disconnect.
> > 
> > FYI, with the pam_ldap-185-11.el6.x86_64 based configured with the 
> > following in /etc/pam_ldap.conf on RHEL 6.4
> > 
> > pam_groupdn cn=GoodUsers,ou=x,ou=y,o=z
> > 
> > and the same sshd package, I get the following when the test group
> > isn't available in the LDAP tree:
> > 
> > [test-client Desktop]$ ssh test-server *You must be a member of
> > cn=GoodUsers,ou=x,ou=y,o=z to login.*
> 
> 
> This is generally a bad practice, as it gives a potential attacker
> information about what they need to do in order to gain access. I'd
> agree that you should at least see "Access denied by server
> configuration" so you know it's kicking you out on purpose (rather
> than a bug). Feel free to file an RFE against SSSD about this.

Sorry to come late to the thread, I'm still going through mail after
vacation. I agree with Stephen, we recently fixed a similar RFE where
binding with the old password in case of a password change also printed
a message saying "Old password not accepted". I think this falls into
the same bucket.

We might only print this extended access control mechanism if the pam
responder is running in some sort of verbose mode (controlled by the
pam_verbosity parameter) but that's tdb.



More information about the sssd-devel mailing list