I have a home server running Fedora 16 I'd like to be able to access remotely via SSH. For users with sudo access, they should only be allowed to connect from the WAN with a key, but I want to allow them to connect with a password from the local network.
Here's my sshd_config:
#Logging SyslogFacility AUTHPRIV #Allow the two types of ssh groups AllowGroups ssh_key_users ssh_pass_users PermitRootLogin no #Accept environment variables - these come from the fedora default config AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE AcceptEnv XMODIFIERS #Other options X11Forwarding yes GSSAPICleanupCredentials yes #Set up sftp subsytem Subsystem sftp /usr/libexec/openssh/sftp-server #Just as a default, we'll change it per network and group PasswordAuthentication no #Re-enable password access for the local network Match Address 192.168.1.0/24 Group ssh_key_users PasswordAuthentication yes #Settings for users which can login by password (non-sudoers) Match Group ssh_pass_users PasswordAuthentication yes ChrootDirectory %h
The fun part is that this works perfectly when I run
sshd -d -p 4000 to put it in debug mode and test it out, but trying to log in with a password when I run sshd through systemctl fails.
As have been most of the problems while configuring this machine, I believe SELinux is the culprit. Here's the error message from audit.log
type=USER_AUTH msg=audit(1345320824.824:123275): pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="chockey" exe="/usr/sbin/sshd" hostname=? addr=192.168.1.201 terminal=ssh res=failed'
If I turn off SELinux temporarily, it does work. If I use audit2why on this message, it gives no output. If I try to use audit2allow on this message, it outputs 3 newlines, but nothing else. Perhaps I'm using it wrong, but here's what I did:
$ tail -n 1 /var/log/audit/audit.log > error.txt $ audit2why -i error.txt $ audit2allow -i error.txt $
Has anyone run into this before? Is it even worth leaving SELinux on?