0

I have this weird situation: On a Centos 6.6 box, in my sshd_config, I have the line

AllowGroups foo bar baz

just like on all the other servers. However, when user baz (whose group is baz) tries to login on this one server, login is denied,

In the logs I see

May 17 16:27:03 myserver sshd[6172]: User baz from other.server.com not allowed because none of user's groups are listed in AllowGroups

And the user cannot login. Of course I have restarted the ssh daemon to make sure the config is picked up.

Also, if I completely remove the 'AllowGroups' line from the sshd_config, login works. Now I am wondering why sshd is not picking up this group (also, users within the group bar can login with AllowGroups active). Also, the (seemingly) exact setup works on other hosts. The configuration is deployed via puppet, so it really should be identical. Any ideas?

Edit as requested below, the output of

root@foobar:/etc/ssh $ groups baz
baz : nburoot

exepcted would be baz as group ... so now I need to check why the group is wrong (even though /etc/groups has it right). I will post the solution as an answer.

closed as off-topic by Jeff Schaller, Stephen Rauch, sebasth, Satō Katsura, Anthon Sep 17 '17 at 12:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – Jeff Schaller, Stephen Rauch, sebasth, Satō Katsura, Anthon
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Maybe the AllowGroups is in a Match section of sshd_cofig ? – Rahul May 17 '16 at 16:56
  • 1
    Please, post whole /etc/ssh/sshd_config with context that is needed. Also post the output of groups baz to make sure the groups are correct. – Jakuje May 17 '16 at 17:53
  • It might also be helpful to know if these are local groups (i.e. defined in /etc/group) or from a directory. – pgoetz May 17 '16 at 18:00
1

Thanks to @Jakuje I checked the group membership with groups baz which showed that the effective group is not what I expecting from the entry in /etc/group. As we also have centrify installed, I looked at the config, which seems correct(baz was listed in /etc/centrifydc/groups.ignore). I restarted the agent (service centrifydc restart), which fixed the issue. baz now has the correct group and can therefor login.

Not the answer you're looking for? Browse other questions tagged or ask your own question.