0

I've started managing a CentOS 7 server for a new client that is managed via Plesk. I'm not familiar with either Centos or Plesk.

If I SSH to the server like: ssh [email protected], immediately upon connecting I see that I'm a different user. Ie whoami shows a completely different user.

Are there any places I can look either via Plesk or on the server to figure how/why it's changing user?

Thanks!

EDIT: Contents of /etc/passwd :

differentuser:x:10000:1003::/var/www/vhosts/example.com:/bin/false
workspaceuser:x:10000:1003::/var/www/vhosts/example.com:/bin/bash
acme-john:x:10000:1003::/var/www/vhosts/example.com/httpdocs:/bin/false
acme_admin:x:10000:1003::/var/www/vhosts/example.com/home.example.com:/bin/false
5
  • This question is not really CentOS or Plesk specific... I'd start with sshd_config and any dotfiles in the home of the user you are logging in as (if that exists)
    – Panki
    Feb 14 at 19:13
  • 3
    Perhaps multiple users have the same uid. Check /etc/passwd for dups.
    – Bib
    Feb 14 at 21:19
  • There are definitely users in /etc/passwd with duplicate UIDs. Would this cause it?
    – Sherri
    Feb 15 at 14:11
  • 1
    Yes - this machine has big issues. You have shown us 4 users with the same UID - there are use-cases for this (but they are rare - and none I know of are applicable in combination with service accounts). Further all of these accounts have been configured to prevent shell access - yet you are able to ssh in - meaning the config is compromising itself (its possible there are further accounts with this uid). This is likely just the tip of the iceberg.
    – symcbean
    Feb 15 at 16:34
  • Yes indeed @symcbean, definitely issues. This was a legacy VPS migrated from one provider to another and not really managed. Doing my best (as a web dev not a sysadmin) to clean things up.
    – Sherri
    Feb 16 at 16:15

1 Answer 1

0

This is being caused by several users including these having the same UID defined in /etc/passwd. (These are all members of the same group.)

When logging in as workspaceuser the UID is set to 10000 but the first user in /etc/password with that UID is differentuser.

All users except workspaceuser have their shell set to /bin/false so they cannot login via SSH.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .