A single unified account for all users on a single machine, while preserving separate credentials

Question

So this is more of a reverse-engineering question.

We have this machine at work, where anyone can login using ssh. ssh johndoe@gateway01. However! Once logged in, the user the person is logged in as is no longer johndoe but an account common for all the users, called daq.

If I do cd ~johndoe, it just redirects me to ~daq.

And more interestingly, if I do ssh daq@gateway01, I get:

This account is currently not available.
Connection to gateway01 closed.

My question is how such a setup could possibly be achieved?

This works for every single user that is present in a list of users somewhere on the machine. This list is in a file called gw_users.

I noticed that in the same folder, there are some more files:

gw_passwd
gw_shadow
gw_group

Answer 1

The "single account with many usernames, each with a separate password" effect could be achieved by having multiple lines in the passwd file with the same UID number. And if the line for username daq has its shell set as /sbin/nologin, it would result in exactly the same response to ssh daq@gateway01 as you're seeing.

The gw_passwd, gw_shadow and gw_group files suggest that there may be a custom PAM configuration in effect on the gateway01 system, possibly using those files as replacements for the standard /etc/passwd//etc/shadow//etc/group files, at least for sshd.

In other words, it might be enlightening to compare /etc/pam.d/sshd (or any files it references using @include directives) on that system to the same file(s) on another system that has the same Linux distribution in a default configuration.

The gw_users file containing the list of users might be used in scripts that maintain and/or generate the gw_passwd and other files, and/or the /etc/ssh/sshd_config file (which might have configured to enforce some additional restrictions to the gateway users).