On a Mac running OSX 10.7.5, I need to set the PATH for non-interactive users who connect via ssh and are authenticated using LDAP. It's the same question that was asked (and answered) here:
but I'm no familiar enough with PAM or LDAP to fully understand the answer.
It looks like I need to:
add a line to /etc/pam.d/sshd saying "auth required pam_env.so" create a file named /etc/security/pam_env.conf
but the documentation for pam_env.conf is really confusing and I can't tell if I need a DEFAULT or an OVERRIDE value.
Am I right that those are the correct steps? What is the line I should put into pam_env.conf?
p.s. I tried putting the line "auth required pam_env.so debug" into /etc/pam.d/sshd and I'm not seeing anything in /var/log/system.log that looks like it is coming from pam_env.so. I also created /etc/security/pam_env.conf and put in it the line "PATH DEFAULT=/usr/fred OVERRIDE=/usr/george" and it had no visible effect on PATH.
p.p.s If I execute:
ssh USER@MACHINE echo \$SHELL
It says /bin/bash. If I then log onto MACHINE and add this line to /etc/bashrc:
and return to my machine and execute:
ssh USER@MACHINE echo \$Test
it returns nothing. When I log on this way using LDAP, it doesn't execute /etc/bashrc.
p.p.p.s Some additional information that might be important: On MACHINE there is no local user named USER. MACHINE has been set up to do LDAP authentication so when I ssh USER@MACHINE, my $HOME is set to /Network/Servers/blah/blah/Users/USER. If I edit /Network/Servers/blah/blah/Users/USER/.bashrc to set the PATH, it works correctly for me, but it's not a great solution because it means every person who wishes to access this server has to edit their network .bashrc.