3

I use the PAM to authenticate users login

info from - http://linux.die.net/man/8/pam_listfile

in my Linux red-hat machine I have 5 diff users

user1
user2
user3
user4
user5

I want to enable ssh login only to the first three users

so

I created the file

more /etc/logins_users.txt

user1
user2
user3

and I add to /etc/pam.d/sshd file the following

   auth required pam_listfile.so item=user onerr=fail sense=allow file=/etc/logins_user.txt

I restart the sshd service

but user4 and user5 are still have access to the linux machine in spite they not defined in the logins_users.txt file

What is wrong with my configuration?

Why user4 and user5 still have ssh login access in spite they are blocked???

1

There is nothing wrong in your configuration.

Write your configuration in first line of /etc/pam.d/sshd like this

#%PAM-1.0
auth       required     pam_listfile.so item=user onerr=fail sense=allow file=/etc/logins_user.txt
auth       required     pam_sepermit.so
auth       include      password-auth
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth

That is because PAM will check all these configuration line by line , if you put your configuration in last line then any other condition will pass before checking your condition , That's why all users all able to login . Check this and let me know.

Be careful while trying this

Before changing anything take a backup of file.

if you configure like this

auth       required     pam_listfile.so item=user onerr=fail sense=allow file=/etc/logins_user.txt
auth       include      password-auth
account    required     pam_nologin.so
.
.
session    include      password-auth

And condition fails still PAM will check remaing rules.

if you configure like this

auth       requisite    pam_listfile.so item=user onerr=fail sense=allow file=/etc/logins_user.txt
auth       include      password-auth
account    required     pam_nologin.so
.
.
session    include      password-auth

And above condition fails , PAM will not check remaing rules.

required

Failure also results in denial of authentication, although PAM will still call all the other modules listed for this service before denying authentication. 

requisite

Failure to authenticate via this module results in immediate denial of authentication. 

So in your case may be below condition giving permission

auth       include      password-auth

You are entering correct password while ssh.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.