0

I am testing out ssh-ldap-pubkey, to get the ssh key from an LDAP server. From auth.log, it shows that my user surfer.example is being closed in preauth and not even running the AuthorizedKeysCommand script.

Aug 13 12:51:57 ubuntu-bionic sshd[1685]: Invalid user surfer.example from 192.168.35.1 port 58997
Aug 13 12:51:57 ubuntu-bionic sshd[1685]: Connection closed by invalid user surfer.example 192.168.35.1 port 58997 [preauth]
Aug 13 12:52:11 ubuntu-bionic sshd[1687]: Invalid user surfer.example from 192.168.35.1 port 59004
Aug 13 12:52:11 ubuntu-bionic sshd[1687]: Connection closed by invalid user surfer.example 192.168.35.1 port 59004 [preauth]
Aug 13 12:56:40 ubuntu-bionic sshd[1691]: AuthorizedKeysCommand /usr/local/bin/ssh-ldap-pubkey-wrapper vagrant failed, status 1
Aug 13 12:56:40 ubuntu-bionic sshd[1691]: Accepted publickey for vagrant from 10.0.2.2 port 59100 ssh2: RSA SHA256:EjagAW+Wdlac37IGrrLJ3/DA/g8qHCZGPGUCyCEGKTc
Aug 13 12:56:40 ubuntu-bionic sshd[1691]: pam_unix(sshd:session): session opened for user vagrant by (uid=0)

What is in /etc/ssh/sshd_config:

AuthorizedKeysCommand /usr/bin/ssh-ldap-pubkey-wrapper
AuthorizedKeysCommandUser nobody

The command used to attempt the ssh is:

$ ssh surfer.example@192.168.35.10
surfer.example@192.168.35.10: Permission denied (publickey).
  • Does a user account by that name actually exist on the system? – grawity Aug 13 at 13:15
  • On the managed ubuntu host? No. On Active Directory accessed with LDAP? Yes. – Stevie G Aug 13 at 13:18
  • Does the Ubuntu host have an LDAP client configured for AD? Is it able to find that account using id surfer.example or getent passwd surfer.example? – grawity Aug 13 at 13:25
  • It is not able to find the account: id: ‘surfer.example’: no such user. – Stevie G Aug 14 at 5:04
  • So...that's your problem then. It's not a public key issue at all – sshd can't log into an account the OS does not recognize. – grawity Aug 14 at 5:12
0

Your log messages show:

Aug 13 12:51:57 ubuntu-bionic sshd[1685]: Invalid user surfer.example from 192.168.35.1 port 58997

You also say that id <username> returns:

id: ‘surfer.example’: no such user

This means it's not a public key auth issue at all – the issue is that the account just completely doesn't exist according to your OS configuration. OpenSSH sshd will never accept logins to a non-existent account (as it does not know what UID/GID to assign, what home directory to use), so it will not even attempt to look up its authorized keys.

If this is supposed to be an Active Directory account, double-check your /etc/nsswitch.conf configuration (whether it lists the AD/LDAP client module, usually ldap or sss or winbind, in the "passwd:" and "group:" lines), as well as the AD/LDAP client daemon itself. It's a system-wide issue and not limited to OpenSSH.

  • Ah ok, I thought the home directory/user creation would happen automatically. So I would need to setup ldap first? Would this be a suitable tutorial: blog.shichao.io/2015/05/21/setup_nss_ldapd_on_ubuntu_14_04.html – Stevie G Aug 14 at 7:08
  • Yes, although SSSD or Samba (winbind) may be more suitable for AD. nslcd is a more generic LDAP client and will need more work to set up. Additionally, unlike that article, accessing AD requires authentication, so you'd have to either use SSSD's realm join or Samba's net join to set it up, or manually create a "computer" account on AD and extract its keytab for sssd/nslcd to use. – grawity Aug 14 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.