0

In our setup, we are forced to use Microsoft Active Directory (AD) for ssh access to our Linux VM, so that when employees leave they can be blocked from accessing the VM once their AD account is deactivated.

We already have all our data and users set up. So my proposed plan is to:

  1. Disable all remote / ssh access to the original user accounts, only allowing access via their new AD accounts.

  2. Upon ssh'ing in to their AD account, they are automatically logged in to their original user account.

I need logname to print out the original user account (i.e. the account they get auto-logged into) and not the new AD account.

  • 1
    Moving the users old home to the new AD name is not an option? – Fiximan Jun 3 at 11:28
  • @Fiximan you also need to change file/directory owner (AD user id are likely different from linux UID). – Archemar Jun 3 at 11:30
  • 1
    Well yes, but a one time job based on a "AD vs old user"- list + chown. Then adjust /etc/passwd. – Fiximan Jun 3 at 11:33
  • 4
    Still, migrating the data (and fixing permissions, adapting scripts to the new name) is the way to go. It might be a bit painful, but it's a one-time thing. Keeping a separate set of accounts can be seen as evading AD authentication and will make management of these "shadow" accounts hard to keep up with. Just bite the bullet and do the migration. – filbranden Jun 3 at 11:35
  • We have 2 VMS with most of the data located on an NFS. So we need both VMs to have identical uids / gids. My initial idea was to change the old user ids, etc to match the new AD users of the second VM. But in some case they are creating shared users that a few of them have access to (instead of groups). Bit of a headache. I would prefer to modify less and allow them to make their own choices of where to log in. We don't need this AD system other than it is a requirement imposed on us. – Dean Kayton Jun 3 at 13:06
1

On a very simplistic base, you could replace the respective login-shell variable in /etc/passwd to a redirection script:

john_AD:x:1000:1000:,,,:/home/john_old:/sbin/redirect_user

And the script would be like

#!/bin/bash
#autoredirect user to old login
case $USER in
   jonh_AD) oldname=john_old
#add list of users
esac

su "$oldname"

Then make sure the AD_user can log into the old user without password, e.g. via a sudoers entry (adapt script to use sudo).


I however still suggest to create an "ID-update" script to be run once with the moving and have a less fiddly set-up in future. This is far more stable, secure and needs just as much effort as such script like above.

  • AD users are not managed in /etc/passwd – Dean Kayton Jun 3 at 13:17
  • su "$oldname" does not result in a full login. See that logname returns a different value to whoami – Dean Kayton Jun 4 at 8:48
0

Edited to use ssh instead of login because it can make use of public-key-authentication and does not need a modification to the sudoers list (by sudo visudo). I also add the command to /etc/bash.bashrc because it has the desired affect of not doing anything if not running interactively. This script becomes a convenience script for users who have not yet set up their ssh clients correctly to use connection tunneling (also known as ssh multihop).

I will add more on the connection tunnelling setup once I have it figured out.


Inspired by the other answer but an alternative approach (because AD users are not listed in /etc/passwd.

Setup:

  • A line in /etc/bash.bashrc (only if you want this to be executed by default on initial login):
# Executes convenience script which prompts all white-listed users whether they wish to login as their default work user account
/bin/login_redirect

This causes the user to login via ssh to their default work user account.

Main Script: /bin/login_redirect (must be executable to all users, chmod +x bin/login_redirect)

!/usr/bin/env bash

generate_divider() {
    user_query="$1"
    user_query_len="${#user_query}"
    user_query_len=$((user_query_len+1))
    str=$(printf "%${user_query_len}s")
    divider="${str// /_}"
}

case "$(logname)" in
    # White-list
    12345632) work_user=dean;;
    12345633) work_user=tom;;
    12345634) work_user=mary;;
esac

work_user="${work_user:-none}"
if [ "${work_user}" != "none" ]; then
    user_query="Do you wish to login as your default work user? [Y/n]: "
    generate_divider "${user_query}"
    echo
    echo "${divider}"
    echo "[WARNING]: You are connected directly to your AD account."
    echo "           Ask the admin of this server for help"
    echo "           configuring a multi-hop ssh connection. This "
    echo "           is a convenience script written to allow"
    echo "           connection to your default work user in the"
    echo "           interim."
    read -p "${user_query}" login_ans
    login_ans="${login_ans:-Y}"
    if [ "${login_ans}" == "Y" ]; then
        echo "Username: ${work_user}"
        exec ssh -t "${work_user}"@"$(hostname)" "echo ${divider}; echo; /bin/bash;"
    fi
fi

Note: If login_redirect is executed by a non work-user, then this would automatically log them in to their default work user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.