0

I am setting my sshd to use kerberos auth. Everything was fine until I actually login via ssh. I got invalid user.

If I added the account to the server running sshd, then I could login using password on kerberos.

Do I have to add the account?

How to make sshd create the account itself?

**pam.d/sshd**, no pam.conf and pam.d/common-*

auth    [success=3      default=ignore] pam_krb5.so     minimum_uid=1000        forwardable=true

auth    [success=2      default=ignore] pam_unix.so     nullok_secure   try_first_pass

auth    [success=1      default=ignore] pam_lsass.so    try_first_pass

auth    requisite       pam_deny.so

auth    required        pam_permit.so

auth    optional        pam_cap.so

account required        pam_nologin.so

account [success=3      new_authtok_reqd=done   default=ignore] pam_unix.so

account [success=ok     new_authtok_reqd=ok     default=ignore] pam_lsass.so    unknown_ok

account [success=1      new_authtok_reqd=done   default=ignore] pam_lsass.so

account requisite       pam_deny.so

account required        pam_permit.so

account required        pam_krb5.so     minimum_uid=1000        forwardable=true

session required        pam_script.so onerr=success dir=/usr/local/etc/security/

session [default=1]     pam_permit.so

session requisite       pam_deny.so

session required        pam_permit.so

session optional        pam_umask.so

session optional        pam_krb5.so     minimum_uid=1000        forwardable=true

session required        pam_unix.so

session sufficient      pam_lsass.so

session optional        pam_ck_connector.so     nox11

session optional        pam_motd.so

session optional        pam_mail.so     standard        noenv

session required        pam_limits.so

session required        pam_env.so

session required        pam_env.so      user_readenv=1  envfile=/etc/default/locale

password        [success=3      default=ignore] pam_krb5.so     minimum_uid=1000        forwardable=true

password        [success=2      default=ignore] pam_unix.so     obscure use_authtok     try_first_pass  sha512

password        [success=1      default=ignore] pam_lsass.so    use_authtok     try_first_pass

password        requisite       pam_deny.so

password        required        pam_permit.so

password        optional        pam_gnome_keyring.so
1
  • Please add information how you configured pam (/etc/pam.conf, /etc/pam.d/sshd, /etc/pam.d/common-*).
    – chaos
    Nov 5, 2013 at 6:35

1 Answer 1

0

From openssh source, sshd cannot deal with non-exist user at all.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .