I have a home server running Fedora 16 I'd like to be able to access remotely via SSH. For users with sudo access, they should only be allowed to connect from the WAN with a key, but I want to allow them to connect with a password from the local network.
Here's my sshd_config:
#Logging
SyslogFacility AUTHPRIV
#Allow the two types of ssh groups
AllowGroups ssh_key_users ssh_pass_users
PermitRootLogin no
#Accept environment variables - these come from the fedora default config
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
AcceptEnv XMODIFIERS
#Other options
X11Forwarding yes
GSSAPICleanupCredentials yes
#Set up sftp subsytem
Subsystem sftp /usr/libexec/openssh/sftp-server
#Just as a default, we'll change it per network and group
PasswordAuthentication no
#Re-enable password access for the local network
Match Address 192.168.1.0/24 Group ssh_key_users
PasswordAuthentication yes
#Settings for users which can login by password (non-sudoers)
Match Group ssh_pass_users
PasswordAuthentication yes
ChrootDirectory %h
The fun part is that this works perfectly when I run sshd -d -p 4000 to put it in debug mode and test it out, but trying to log in with a password when I run sshd through systemctl fails.
As have been most of the problems while configuring this machine, I believe SELinux is the culprit. Here's the error message from audit.log
type=USER_AUTH msg=audit(1345320824.824:123275):
pid=0 uid=0 auid=4294967295 ses=4294967295
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023
msg='op=password acct="chockey" exe="/usr/sbin/sshd"
hostname=? addr=192.168.1.201 terminal=ssh res=failed'
If I turn off SELinux temporarily, it does work. If I use audit2why on this message, it gives no output. If I try to use audit2allow on this message, it outputs 3 newlines, but nothing else. Perhaps I'm using it wrong, but here's what I did:
$ tail -n 1 /var/log/audit/audit.log > error.txt
$ audit2why -i error.txt
$ audit2allow -i error.txt
$
Has anyone run into this before? Is it even worth leaving SELinux on?
