24

Is ssh abc@servername different from ssh Abc@servername? Does the case of the username matter in Unix?

My user authenticates via LDAP.

Improve this question
3
  • 3
    Almost everything in Linux is case-sensitive. Meaning: cd is not the same as CD...Only way to really make them mean the same is to set aliases in your .bashrc file..
    – ryekayo
    Commented Oct 9, 2015 at 15:51
  • 1
    I suppose that depends on what LDAP attribute you use for the username. If it's uid from RFC 4519, then it's case insensitive, but authentication implementations may still impose case significance on top of it. It also depends on how exactly the authentication is done with LDAP.
    – Stéphane Chazelas
    Commented Oct 9, 2015 at 16:10
  • 1
    Simply trying to login with your username capitalised would have answered this for you in mere seconds.
    – Lightness Races in Orbit
    Commented Oct 9, 2015 at 23:30

5 Answers 5

Reset to default
19

Just like hostnames and domain names, the username is not strictly a Unix thing but can and often does span a wider range of OS types.

Whether they will be considered case sensitive depends then on the standard used to specify them.

Hostnames and domain names are clearly case insensitive by the DNS standard (see RFC4343).

Usernames stored on a local backend (/etc/passwd) or a Unix style one (NIS) are not case insensitive by the POSIX standard.

Usernames stored in an LDAP or an Active Directory backend will follow the used attribute schema definition, uid and cn which are often storing the user name have a differing schema attributes, case insensitive for the former but case sensitive for the latter. That means both Abc and abc might match or not abc's entry depending on the ldap server configuration.

Due to this inconsistency, I would recommend to only use lowercase for both usernames and host/domain name and then avoid ssh [email protected] which is rude anyway.

Improve this answer
3
  • 2
    So, the way I read the POSIX standard, since it's not specified as either case-sensitive or -insensitive and the entire portable filename character set is available (which includes both upper- and lower-case), it would be implementation-dependent. Is that correct? That being said, is there a standard convention?
    – Deacon
    Commented Aug 24, 2016 at 13:25
  • 2
    @DougR. As far as POSIX is concerned, usernames are case dependent. Case insensitivity would have otherwise been specified. Case sensitivity is implicit when referring to the portable filename character set.
    – jlliagre
    Commented Aug 24, 2016 at 13:34
  • Thanks for the clarification. That was my initial assumption, but I couldn't find anything regarding the portable filename character set that stated this for certain one way or the other.
    – Deacon
    Commented Aug 24, 2016 at 13:36
6

Yes it is case sensitive. I'm not able to bring technical informations, I've just tested it, and wondering why you didn't(?)

my local machine is linux mint as you can see:

# cat /etc/*release
DISTRIB_ID=LinuxMint
DISTRIB_RELEASE=17.2
DISTRIB_CODENAME=rafaela
DISTRIB_DESCRIPTION="Linux Mint 17.2 Rafaela"
NAME="Ubuntu"
VERSION="14.04.3 LTS, Trusty Tahr"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 14.04.3 LTS"
VERSION_ID="14.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
cat: /etc/upstream-release: Is a directory

and I've tried to connect to CentOS server like this:

· Using (wrong) Uppercase username: 

8D prova # ssh Root@agora-server
Root@agora-server's password: 
Permission denied, please try again.
Root@agora-server's password: 
Permission denied, please try again.
Root@agora-server's password:

· Using correct username:

8D prova # ssh root@agora-server
root@agora-server's password: 
Last login: Fri Oct  2 01:50:13 2015 from 192.168.0.31
[root@agora-server ~]#
Improve this answer
2
  • As a side issue, it is not a good practice security wise to allow SSH login as root as was done here (particularly if the machine is Internet facing) 😱 These days with OpenSSH this usually has to be explicitly enabled with the PermitRootLogin option in the in the sshd_config. It is preferable to login as a normal user and then use sudo or su to become root only when needed.
    – JohnGH
    Commented Jun 20, 2018 at 7:33
  • Yes that's correct I agree, first because it's a superuser, and secondly the 'root' username is known by the attacker, which only have to catch the password. Anyway this is actually just a Virtual Machine running locally, not exposed to the interned. Good practice is to use rsa ssh certificates to login, or / plus open ssh port only for requests coming from the allowed addresses (firewall rules)
    – lese
    Commented Jun 21, 2018 at 8:58
3

In case of local accounts the username is case sensitive. When you use LDAP, it depends. I've seen cases where the username is case sensitive (on a ZFS appliance connected to LDAP) and cases where it does not matter like Solaris LDAP client connected to Windows AD.

What you should/could try is to see whether your system is using LDAP correctly by issuing getent passwd <username>. Using this command should give you a record with the username, home directory and shell for the specified user. If you do not see such record, LDAP is not configured correctly.

There are several places where you should configure LDAP and one of the places is:

/etc/nsswitch.conf

passwd: files ldap
group:  files ldap

You also need to check if PAM is configured correctly and maybe the most important step is to verify if the LDAP client is configured and working. Try a tool like ldapsearch to check if LDAP can be queried.

There are several LDAP cookbooks available and most of them depend on the Unix version and LDAP version you are using. Update your question with those details if you need further assistance. Also include your configuration setup (without passwords of course) which can help forum members to analyse your particular issue.

Improve this answer
2

Unix usernames are definitely case-sensitive, and what is more, using usernames with uppercase characters on Unix systems can produce unwanted results, so should generally be avoided.

Some examples are:

It can break email for the user. The standards for SMTP allow email addresses to be case-insensitive, and by default the MTA receiving the message will fold the email address to lowercase to find the user to deliver to. If the username has uppercase characters it will then not be resolved without special config overrides to cater for this. (this affects MTAs such as sendmail, postfix etc and also delivery processing agents like procmail)

Many early hardware terminals were not case sensitive. It was common that they only used uppercase. When logging in to some versions of Unix, starting a login name with an uppercase character will trigger the system to assume that you're using an ancient uppercase only terminal and it will enable case folding - which converts all of your entered uppercase to lowercase (you then have to escape uppercase characters to say that they're uppercase) to help you to enter your username which it expects will be in lowercase. I don't believe this is a thing on Linux, but I've seen it demonstrated on HP-UX.

As it has long been the convention to only use lowercase characters in usernames, it's reasonable to expect that other tools (some we may not have thought of) on the system may also assume that the username should be lowercase, and make checks, conversions etc accordingly, thus breaking things for that user.

Improve this answer
1

The user names are definitely case sensitive. You can easily test this by adding two users with similar names:

~ # useradd foobar
~ # useradd fooBar
~ # grep ^foo /etc/passwd
foobar:x:1001:1001::/home/foobar:/bin/sh
fooBar:x:1002:1002::/home/fooBar:/bin/sh

This question/answer shows how to compensate for someone trying to log in with the a username that has the "wrong" case according to the LDAP servers. But note that this will only work if the usernames are all listed as lowercase (or you can make them all uppercase if you want).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .