0

What would stop the following command from re-attaching to an existing screen session on a remote server ?

ssh -t server2 "screen -dr admin"

Machines server1 and server2 both have screen sessions named 'admin' running. On server1, the command runs perfectly, re-attaching to the 'admin' screen session. But, when attempting the same on server2, the connection is closed with this message:

"screen" isn't allowed to be executed.
Connection to server2 closed.

server1's /var/log/auth.log on a successul re-attachment to screen session:

Jul 13 04:40:02 server1 sshd[3995]: Accepted publickey for dbkeys from 192.168.1.170 port 52434 ssh2: RSA a4:41:1e:62:66:33:35:5f:b0:d4:a7:cd:d9:b1:20:0d
Jul 13 04:40:02 server1 sshd[3995]: pam_unix(sshd:session): session opened for user dbkeys by (uid=0)
Jul 13 04:40:02 server1 systemd-logind[1144]: Removed session 9.
Jul 13 04:40:02 server1 systemd-logind[1144]: New session 10 of user dbkeys

server1 is running Linux Mint 17.3

server1 # uname -a
Linux server1 3.19.0-32-generic #37~14.04.1-Ubuntu SMP Thu Oct 22 09:41:40 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
server1 # cat /etc/issue
Linux Mint 17.3 Rosa \n \l

server2's /var/log/auth.log on failed re-attachment attempt to screen session:

Jul 13 11:40:32 server2 sshd[21144]: Accepted publickey for dbkeys from 77.225.135.132 port 52437 ssh2: RSA SHA256:uidABN1IbiI7jQx10VmpWrbCGgyTkGwJaIHiiG6crPI
Jul 13 11:40:32 server2 sshd[21144]: pam_unix(sshd:session): session opened for user dbkeys by (uid=0)
Jul 13 11:40:32 server2 systemd-logind[546]: New session 203 of user dbkeys.
Jul 13 11:40:32 server2 sshd[21183]: Received disconnect from 77.225.135.132 port 52437:11: disconnected by user
Jul 13 11:40:32 server2 sshd[21183]: Disconnected from 77.225.135.132 port 52437
Jul 13 11:40:32 server2 sshd[21144]: pam_unix(sshd:session): session closed for user dbkeys
Jul 13 11:40:32 server2 systemd-logind[546]: Removed session 203.

server 2 is running Ubuntu 16.04.2

root@server2:/var/log# uname -a
Linux audit.bitmark.io 4.4.0-83-generic #106-Ubuntu SMP Mon Jun 26 17:54:43 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
root@server2:/var/log# cat /etc/issue
Ubuntu 16.04.2 LTS \n \l

server1's and server2's /etc/ssh/sshd_config files are identical

What is not allowing screen to be executed on server2 ?

1

The problem was the login shell. On server 2, sudosh was being used as the login shell, instead of /bin/bash

Relevant line in /etc/passwd:

dbkeys:x:1000:1000:DBKeys,,,:/home/dbkeys:/usr/local/bin/sudosh

but, in /etc/sudosh.conf, the program screen has to be explicity allowed to run:

# Sudosh Configuration File
logdir                  = /var/log/sudosh
default shell           = /bin/bash
delimiter               = -
syslog.priority         = LOG_INFO
syslog.facility         = LOG_LOCAL2
clearenvironment        = yes

# Allow Sudosh to execute -c arguments?  If so, what?
-c arg allow = scp
-c arg allow = rsync
-c arg allow = screen

Adding the line -c arg allow = screen at the end of sudosh.conf solved the problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.