0

I have setup Redhat host to authenticate AD users for ssh sessions. Everything is working as expected, however, single concern, user credentials are being cached somewhere.

Upon first time login using ssh, user is asked to enter the password however, later on (second third attempts etc), whenever user initiates the ssh connection, ssh connection is established without even prompting to enter the password. This could be a security risk.

How can I prevent caching the credentials and have the user enter password each time when they want to connect to the RHEL server.

/etc/sssd/sssd.conf

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3

[pam]
reconnection_retries = 3

[domain/example.com]
ad_domain = example.com
krb5_realm = EXAMPLE.COM
realmd_tags = manages-system joined-with-samba
cache_credentials = false
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = simple
simple_allow_groups = Domain Admins
1

This is not SSSD caching credentials, but SSH either logging you with GSSAPI or with public key. Even when SSSD caches credentials, it always prompts you for the password.

0

I figured out the issue, SSH Sessions Credentials were being cached in my terminal. MobaX freeware was being used with "save password" defaults to yes. Cleared the password vault.

  ¯\_(ツ)_/¯  ¯\_(ツ)_/¯

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.