6

I have an Apache server (RHEL 6) hosting multiple user web pages which currently is connected to my Active Directory environment to authenticate users. The server is used to automatically host content the users put in their /home/<user>/public_html folder. I am also configuring this server to use chroot so the users will not be able to browse any other content on the server outside of their home folder. The login scripts do not create a home folder for the users. Those are created manually because we only want certain users to be able to host web pages from this server.

The problem is, any user is currently able to log into the server and instead of going to their /home folder (because it doesn't exist) they automatically go into /. This gives them access to view any files/folders on the server their group has read access to. This is a security concern and I'd like to restrict logins to users who have a /home directory. We don't want to specify an AD group or list of users as authenticated because that list may get quite long and be difficult to manage although it may be easier than writing a PAM module.

Is there a way to restrict LDAP logins to only users who already have a /home directory? I am not finding anything in the PAM options or documentation.

Improve this question
6
  • What effect does adding oddjob's mkhomedir module to the stack have? That should create the required home directory, the part I'm just not sure what effect that will have on the user's initial login (Chroot-wise). – Bratchley Mar 21 '13 at 23:49
  • Do you need to restrict only ssh (terminal) logins, or do you also need to restrict sftp/scp access? It would be relatively easy to restrict ssh logins to accounts with a valid home directory, but I can't think of an easy way to restrict sftp/scp access in a similar manner. – user Mar 22 '13 at 10:53
  • @JoelDavis Adding oddjob mkhomedir creates the home dir and puts the user in the directory. – Rothgar Mar 22 '13 at 16:39
  • @MichaelKjörling We actually are disallowing ssh entirely and only allow sftp – Rothgar Mar 22 '13 at 16:40
  • @Rothgar does it Chroot them or does SSH check for the home dir before oddjob is able to come into the picture? You'll probably also have to make sure all required files get copied in from the skeleton directory. – Bratchley Mar 22 '13 at 20:13
2

Because the management of access would require a lot of work arounds on the local host we decided just to create a group in Active Directory and restrict logins to users in that group.

This can be done by editing the /etc/security/pam_winbind.conf file with the following field with the SIDs of the groups or users we want to restrict access to (comma separated).

require_membership_of=

We then will filter our chroot restrictions to that group (or put the users to a local group) to restrict their sftp access to their own home directories. This will also allow us to add the oddjobs mkhomedir back to pam and then to allow access to the server we just have to add the user to that group. They can then log in and their home dir will be created automatically.

Thanks everyone for the help/ideas but it looks like AD groups will be the easiest to manage after all.

Improve this answer
1

Solution 1:

You can PAM module pam_homecheck

All it does is check if there is a home directory of the user and refuses a session if none is found.

the issue is , it's only available in openSUSE , but you can place pam_homecheck.so from downloaded packages and install dependency with help of ldd pam_homecheck.so.

Solution 2: you can add below content in /etc/bashrc but Only applicable for shell/putty login 

[[ $HOME == / ]] && { echo "Error: Home Dir not define.."; exit 1; }

Solution 3:

Deny if home dir not set (tested and working below steps in Ubuntu)

To Deny WinScp 

aptitude install libpam-script

Open "/etc/pam.d/common-auth" with your faorite editor and add below entries

auth optional pam_script.so  # add at the last

Open "/usr/share/libpam-script/pam_script_auth" with your favorite editor and add below entries 

#!/bin/bash

Pam_home=$(awk -v u=$PAM_USER -F: '($1 == u ){print $6}' /etc/passwd)

if [[ $Pam_home == / ]]; then
        echo "Error: Home Dir not define.."
        kill -9 $PPID # Force fully kill winscp pid
else
        /usr/lib/openssh/sftp-server
fi

To deny from Shell/putty login

It will refer and run same script from default location i.e "/usr/share/libpam-script/pam_script_auth" Or you can verify in logs "tail -f /var/log/auth.log"

Improve this answer
0

One way of going about this would be to force them to use keys for ssh, and prohibit ssh logins using passwords. That way only people with a /home/<user>/.ssh/authorized_keys file will be able to connect.

Improve this answer
3
  • 1
    I think that partially defeats the purpose of using LDAP for authentication. – jordanm Mar 22 '13 at 0:12
  • I guess that depends on whether or not the user comes from a linux box. If they do they still have to authenticate against LDAP to be able to ssh in in the first place, and even more so if their home resides on an NFS server. – tink Mar 22 '13 at 0:14
  • I like the idea but some of the accounts are managed by groups of people and not just individuals. I don't think this would make sense to have them manage passing around keys to all the people/computers that need to log in via sftp to upload files. – Rothgar Mar 22 '13 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.