Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My question is the next, Could I create users in server (on sshd), when ssh client connect to the server and in this moment create account in server with a spectific group and permissions for this login request?

So, If user doesnt exist in SERVER, SSHD or PAM must create and allow log with credentials from the user that wants connect? Like one step and automatic login.

Thanks in advance.

share|improve this question

1 Answer 1

up vote 0 down vote accepted

While it's theoretically possible, it's not easy and it's a really bad idea.

The reason it's a bad idea is that you would effectively give the entire internet access to your server if only they figure out a username that does not already exist.

Still, here are three ways to make it work.

The easiest way is to have a script that is watching /var/log/auth.log and looking for failed logins, and when someone is trying to login to a non-existent user it'd create that user. This will require the user to try a second time in order to actually get access.

A second way would be to use a pam module to allow random users to login even when they don't exist. Or you could use kerberos, and setup a kerberos server that will answer positively to any login request regardless of the username.

A third way would be to rewrite the sshd source to create the user when someone tries to connect.

And I strongly advise you against using any of these ideas on any server connected to the internet.

share|improve this answer
2  
Listen to Jenny, this is a VERY BAD idea!!! Unless your goal is to show how quickly you can hand over your machine to someone on the net. –  Jason H Jun 3 '13 at 12:09
    
Thanks, but I need log user from my application and it will do that the user will be created on the fly. –  ManuParra Jun 3 '13 at 16:41
    
So it's your application that's using ssh, not the user directly? If that's the case, then it's a lot simpler. –  Jenny D Jun 4 '13 at 5:16
    
I've thought a bit more. It seems to me that this is an XY problem (meta.stackexchange.com/questions/66377/what-is-the-xy-problem). If what you really want is for your application to create users on the fly, then there are other ways to do this without opening up a giant big security hole large enough to fly the Enterprise through. Maybe you could post about the actual problem instead? –  Jenny D Jun 4 '13 at 7:08
    
Yes I understand! –  ManuParra Jun 4 '13 at 18:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.