In our setup, we are forced to use Microsoft Active Directory (AD) for ssh access to our Linux VM, so that when employees leave they can be blocked from accessing the VM once their AD account is deactivated.

We already have all our data and users set up. So my proposed plan is to:

  1. Disable all remote / ssh access to the original user accounts, only allowing access via their new AD accounts.

  2. Upon ssh'ing in to their AD account, they are automatically logged in to their original user account.

I need logname to print out the original user account (i.e. the account they get auto-logged into) and not the new AD account.

  • 1
    Moving the users old home to the new AD name is not an option?
    – FelixJN
    Commented Jun 3, 2019 at 11:28
  • @Fiximan you also need to change file/directory owner (AD user id are likely different from linux UID).
    – Archemar
    Commented Jun 3, 2019 at 11:30
  • 1
    Well yes, but a one time job based on a "AD vs old user"- list + chown. Then adjust /etc/passwd.
    – FelixJN
    Commented Jun 3, 2019 at 11:33
  • 4
    Still, migrating the data (and fixing permissions, adapting scripts to the new name) is the way to go. It might be a bit painful, but it's a one-time thing. Keeping a separate set of accounts can be seen as evading AD authentication and will make management of these "shadow" accounts hard to keep up with. Just bite the bullet and do the migration.
    – filbranden
    Commented Jun 3, 2019 at 11:35
  • We have 2 VMS with most of the data located on an NFS. So we need both VMs to have identical uids / gids. My initial idea was to change the old user ids, etc to match the new AD users of the second VM. But in some case they are creating shared users that a few of them have access to (instead of groups). Bit of a headache. I would prefer to modify less and allow them to make their own choices of where to log in. We don't need this AD system other than it is a requirement imposed on us.
    – dnk8n
    Commented Jun 3, 2019 at 13:06

2 Answers 2


On a very simplistic base, you could replace the respective login-shell variable in /etc/passwd to a redirection script:


And the script would be like

#autoredirect user to old login
case $USER in
   jonh_AD) oldname=john_old
#add list of users

su "$oldname"

Then make sure the AD_user can log into the old user without password, e.g. via a sudoers entry (adapt script to use sudo).

I however still suggest to create an "ID-update" script to be run once with the moving and have a less fiddly set-up in future. This is far more stable, secure and needs just as much effort as such script like above.

  • AD users are not managed in /etc/passwd
    – dnk8n
    Commented Jun 3, 2019 at 13:17
  • su "$oldname" does not result in a full login. See that logname returns a different value to whoami
    – dnk8n
    Commented Jun 4, 2019 at 8:48

Edited to use ssh instead of login because it can make use of public-key-authentication and does not need a modification to the sudoers list (by sudo visudo). I also add the command to /etc/bash.bashrc because it has the desired affect of not doing anything if not running interactively. This script becomes a convenience script for users who have not yet set up their ssh clients correctly to use connection tunneling (also known as ssh multihop).

I will add more on the connection tunnelling setup once I have it figured out.

Inspired by the other answer but an alternative approach (because AD users are not listed in /etc/passwd.


  • A line in /etc/bash.bashrc (only if you want this to be executed by default on initial login):
# Executes convenience script which prompts all white-listed users whether they wish to login as their default work user account

This causes the user to login via ssh to their default work user account.

Main Script: /bin/login_redirect (must be executable to all users, chmod +x bin/login_redirect)

!/usr/bin/env bash

generate_divider() {
    str=$(printf "%${user_query_len}s")
    divider="${str// /_}"

case "$(logname)" in
    # White-list
    12345632) work_user=dean;;
    12345633) work_user=tom;;
    12345634) work_user=mary;;

if [ "${work_user}" != "none" ]; then
    user_query="Do you wish to login as your default work user? [Y/n]: "
    generate_divider "${user_query}"
    echo "${divider}"
    echo "[WARNING]: You are connected directly to your AD account."
    echo "           Ask the admin of this server for help"
    echo "           configuring a multi-hop ssh connection. This "
    echo "           is a convenience script written to allow"
    echo "           connection to your default work user in the"
    echo "           interim."
    read -p "${user_query}" login_ans
    if [ "${login_ans}" == "Y" ]; then
        echo "Username: ${work_user}"
        exec ssh -t "${work_user}"@"$(hostname)" "echo ${divider}; echo; /bin/bash;"

Note: If login_redirect is executed by a non work-user, then this would automatically log them in to their default work user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .