I'm configuring some servers to use LDAP (via PAM) to authenticate users. Additionally, I use pam_group to add all users to some system groups like audio/video/vboxusers/....

My PAM configuration works fine with most services (su, login and sudo all take pam_group into account), but not with SSH. Specifically, when I authenticate with a public key, groups are not added from /etc/security/group.conf, but they are when I authenticate with a password.

Looking around, I've found that SSH public key authentication bypasses the PAM stack and sets user credentials by itself, so it ignores PAM-specific configurations such as pam_group. Weirdly, LDAP groups -- which are usually set by pam_ldap -- are set in all cases, password or no.

I'd like the user experience to be as predictable as possible for my users, so that they're always members of the same set of groups regardless of their authentication method. Is there any way to configure SSH to add groups from /etc/security/group.conf when using pubkey authentication ?

Thanks in advance,

  • how does your line /etc/pam.d/sshd looks like? Or the files included from there, where you have the pam_group? When you do pubkey authentication, the PAM does only session, account, but not the auth part. – Jakuje Jul 13 '16 at 10:16

Probably not.

The man page for pam_group says:

Only the auth module type is provided.

And since SSH doesn't use PAM to authenticate when it uses public keys, the auth modules are not used.

As to why pam_group only works as an auth module and not as a session module, I can't say.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.