Hi,
We have a Solaris 10 system that authanticates users against an LDAP
server with password management.
On port 22 runs Sun SSH 1.1. On port 2222 runs OpenSSH 4.3p2. OpenSSH
uses a configuration from a Linux system where login with password or
public key works.
Adittionally we have a customized PAM module that grants/revokes access
based upon an attribute setting in LDAP.
The PAM Configuration for Sun SSH 1.1 is:
==CUT=login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_unix_cred.so.1
login auth required pam_dial_auth.so.1
login auth binding pam_unix_auth.so.1 server_policy
login auth required pam_ldap.so.1
sshd-password account required pam_mymodule.so.1
sshd-none account required pam_mymodule.so.1
sshd-kbdint account required pam_mymodule.so.1
sshd-pubkey account required pam_mymodule.so.1
sshd-hostbased account required pam_mymodule.so.1
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth required pam_unix_cred.so.1
other auth binding pam_unix_auth.so.1 server_policy
other auth required pam_ldap.so.1
passwd auth binding pam_passwd_auth.so.1 server_policy
passwd auth required pam_ldap.so.1
cron account required pam_unix_account.so.1
other account requisite pam_roles.so.1
other account binding pam_unix_account.so.1 server_policy
other account required pam_ldap.so.1
other session required pam_unix_session.so.1
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
other password required pam_authtok_store.so.1 server_policy
==CUT=
This works fine with Sun SSH 1.1. Access is granted and revoked
correctly, even if the user has placed his public key in .ssh/authorized
keys.
Using OpenSSH 4.3p2 with the above configuration this PAM module never
gets executed. Login with password works but with public key
authentication fails with "connection closed" and the debug messages
in
syslog:
==CUT=debug1: fd 6 clearing O_NONBLOCK
debug1: rexec start in 6 out 6 newsock 6 pipe 8 sock 1
debug1: Forked child 1250.
debug1: inetd sockets after dupping: 5, 5
Connection from 192.168.1.123 port 58541
debug1: Client protocol version 2.0; client software version OpenSSH_4.2
debug1: match: OpenSSH_4.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_4.3
debug1: PAM: initializing for "user1"
debug1: PAM: setting PAM_RHOST to "host1.domain.tld"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: temporarily_use_uid: 1468/1000 (e=0/0)
debug1: trying public key file /home/user1/.ssh/authorized_keys
debug1: matching key found: file /home/user1/.ssh/authorized_keys, line 1
Found matching RSA key: 33:dd:ee:66:cc:33:11:33:44:dd:55:ee:00:33:00:ff
debug1: restore_uid: 0/0
debug1: temporarily_use_uid: 1468/1000 (e=0/0)
debug1: trying public key file /home/user1/.ssh/authorized_keys
debug1: matching key found: file /home/user1/.ssh/authorized_keys, line 1
Found matching RSA key: 33:dd:ee:66:cc:33:11:33:44:dd:55:ee:00:33:00:ff
debug1: restore_uid: 0/0
debug1: ssh_rsa_verify: signature correct
debug1: do_pam_account: called
Failed publickey for noglera from 192.168.1.123 port 58541 ssh2
debug1: do_cleanup
debug1: PAM: cleanup
==CUT=
How is the correct PAM configuration for Solaris 10 and OpenSSH 4.3p2 so
that login with password or public key works?
How has an additional PAM module to be inserted to work with OpenSSH?
I found this PAM configuration:
sshd auth requisite pam_authtok_get.so.1
sshd auth required pam_dhkeys.so.1
sshd auth sufficient pam_unix_auth.so.1
sshd auth required pam_ldap.so.1 try_first_pass
sshd account required pam_unix_account.so.1
But with this config the password login of OpenSSH does not work. Only
public key login does work. This is because the LDAP UserPassword is not
readable. Authentication must be done with LDAP bind and not LDAP
search/compare.
Thanks in advance.
Regards,
Bernd