2

I want to achieve a delay with the login over ssh on a Linux Server.

I will describe the scenario and why I might need that:

  • I have a CIFS mount on the server (Domain joined) over fstab with multiuser option
  • The user has his home directory on this mount which is managed by ACLs and MS AD
  • with cifscreds the user authenticates himself against the AD to access the specified folder
  • the home folder location ist specified by the sssd config
  • the cifscreds credentials is handed over by pam in the login process

Now to the Problem: The user initially logs onto the server (Domain joined) with his AD credentials and successfully enters the server. But the process is to fast for cifscreds so I will get an error on the first login and land on root /. The user does not have the rights to be on the mounted "home folder" at this time. A second later he would be. So he logs off and back in, keyring is read, permission granted and he is in his mounted home directory.

So I need a delay in the whole ssh login process, so he reaches his home directory after the credentials are stored in the keyring.

Any ideas? Thanks in advance

Improve this question
1
  • 1
    Are you using PAM? pam_exec.so can execute a custom script when authenticating the user or opening a session. Be careful; a possible DoS attack vector could be created.
    – spuck
    Commented Feb 5, 2021 at 15:49

1 Answer 1

Reset to default
0

Sounds like a messy situation, but echo sleep 1 >~/.bash_profile would cause a delay of 1 second each time a bash shell is invoked for the user.

Improve this answer
5
  • user bash shell (and home dir) is not available at login time.
    – Archemar
    Commented Feb 5, 2021 at 15:30
  • The problem is, that there is no local home folder on the first hand. The user is stuck at root with no rights. So no ~/.bash_profile.
    – Nils
    Commented Feb 5, 2021 at 15:41
  • Ahh right. Maybe introducing a pam_delay module would help then ? Example here, where it delays on authentication failure, so would need tweaking to delay on success... github.com/linux-pam/linux-pam/blob/master/libpam/pam_delay.c Or have a play with sshd_config's ForceCommand param ?
    – steve
    Commented Feb 5, 2021 at 15:55
  • If this is the only user on the machine, or every user on the machine is mounted the same way, then maybe this can go in /etc/bash.bashrc?
    – Stewart
    Commented Feb 5, 2021 at 18:49
  • Thanks for the suggestions. I played with the ForceCommand and build a script which cd's the User always in his home directory. There is still the error message on the first login thou. My Problem is still, that I can't identify where I have to slow down the whole PAM Process. pam_delay could then be the solution. Any ideas? I can paste the pam.d/ssh config
    – Nils
    Commented Feb 9, 2021 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .