I am setting my sshd
to use kerberos auth. Everything was fine until I actually login via ssh. I got invalid user.
If I added the account to the server running sshd
, then I could login using password on kerberos.
Do I have to add the account?
How to make sshd create the account itself?
**pam.d/sshd**, no pam.conf and pam.d/common-*
auth [success=3 default=ignore] pam_krb5.so minimum_uid=1000 forwardable=true
auth [success=2 default=ignore] pam_unix.so nullok_secure try_first_pass
auth [success=1 default=ignore] pam_lsass.so try_first_pass
auth requisite pam_deny.so
auth required pam_permit.so
auth optional pam_cap.so
account required pam_nologin.so
account [success=3 new_authtok_reqd=done default=ignore] pam_unix.so
account [success=ok new_authtok_reqd=ok default=ignore] pam_lsass.so unknown_ok
account [success=1 new_authtok_reqd=done default=ignore] pam_lsass.so
account requisite pam_deny.so
account required pam_permit.so
account required pam_krb5.so minimum_uid=1000 forwardable=true
session required pam_script.so onerr=success dir=/usr/local/etc/security/
session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session optional pam_umask.so
session optional pam_krb5.so minimum_uid=1000 forwardable=true
session required pam_unix.so
session sufficient pam_lsass.so
session optional pam_ck_connector.so nox11
session optional pam_motd.so
session optional pam_mail.so standard noenv
session required pam_limits.so
session required pam_env.so
session required pam_env.so user_readenv=1 envfile=/etc/default/locale
password [success=3 default=ignore] pam_krb5.so minimum_uid=1000 forwardable=true
password [success=2 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512
password [success=1 default=ignore] pam_lsass.so use_authtok try_first_pass
password requisite pam_deny.so
password required pam_permit.so
password optional pam_gnome_keyring.so
/etc/pam.conf, /etc/pam.d/sshd, /etc/pam.d/common-*
).