2

I configure ssh authorization to drop some users with rules, defined in script, and also give them some extended capabilities when they login. I use two pam modules - pam_script and pam_cap and change sshd pam config (/etc/pam.d/sshd) so it looks like that (only first two lines are custom):

#%PAM-1.0
auth       required     pam_script.so
auth       required     pam_cap.so
auth       required     pam_sepermit.so
auth       substack     password-auth
auth       include      postlogin
# Used with polkit to reauthorize users in remote sessions
-auth      optional     pam_reauthorize.so prepare
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    required     pam_namespace.so
session    optional     pam_keyinit.so force revoke
session    include      password-auth
session    include      postlogin
# Used with polkit to reauthorize users in remote sessions
-session   optional     pam_reauthorize.so prepare

Password authentication is allowed, and now user can authorize through Pkey or password. If user authorizes through password, pam_script works well, and those users who doesn't stand rules are dropped. But, if same user authorizes through Pkey, then pam auth section seems to be bypassed, pam_script is not invoked at all. Doesn't sshd use pam auth when authorizing users with Pkey?

0

PAM is used as a KeyboardAuthentication subsystem and is not invoked by PubkeyAuthentication. You may drop user at session creation instead of authentication.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.