I ran into a strange issue with configuring PAM trying to restrict ssh logins by pam_access.so with package libpam-modules_1.1.8-3.6ubuntu2.18.04.1.
contents of /etc/security/access.conf
+ : root : ALL
+ : devops : ALL
#+ : computer managers : ALL
- : ALL : ALL
contents of /etc/pam.d/sshd
account required pam_access.so listsep=, debug
with this setting, each and every user is allowed to login no matter whether they're in any specified group or not.
If i remove listsep=,
from PAM config, then it works as it supposed to.
from debug logs It looks like whenever listsep
is specified it is not returning any error when it can't find the user group in access.conf AKA pam_access.so will always return success with listsep.
In below context user is a member of "computer managers" but not "devops"
Debug logs with listsep enabled and only devops in access.conf
pam_access(sshd:account): line 1: + : root : ALL
pam_access(sshd:account): list_match: list= root , item=user
pam_access(sshd:account): user_match: tok= root , item=user
pam_access(sshd:account): string_match: tok= root , item=user
pam_access(sshd:account): user_match=0, "user"
pam_access(sshd:account): line 2: + : devops : ALL
pam_access(sshd:account): list_match: list= devops , item=user
pam_access(sshd:account): user_match: tok= devops , item=user
pam_access(sshd:account): string_match: tok= devops , item=user
pam_access(sshd:account): user_match=0, "user"
pam_access(sshd:account): line 4: - : ALL : ALL
pam_access(sshd:account): list_match: list= ALL , item=user
pam_access(sshd:account): user_match: tok= ALL , item=user
pam_access(sshd:account): string_match: tok= ALL , item=user
pam_access(sshd:account): user_match=0, "user"
Accepted password for user from IP port PORT ssh2
see the last pam_access log line user_match=0
. let's compare it with logs from when listsep is not specified
pam_access(sshd:account): line 1: + : root : ALL
pam_access(sshd:account): list_match: list= root , item=user
pam_access(sshd:account): user_match: tok=root, item=user
pam_access(sshd:account): string_match: tok=root, item=user
pam_access(sshd:account): user_match=0, "user"
pam_access(sshd:account): line 2: + : devops : ALL
pam_access(sshd:account): list_match: list= devops , item=user
pam_access(sshd:account): user_match: tok=devops, item=user
pam_access(sshd:account): string_match: tok=devops, item=user
pam_access(sshd:account): user_match=0, "user"
pam_access(sshd:account): line 4: - : ALL : ALL
pam_access(sshd:account): list_match: list= ALL , item=user
pam_access(sshd:account): user_match: tok=ALL, item=user
pam_access(sshd:account): string_match: tok=ALL, item=user
pam_access(sshd:account): user_match=2, "user"
pam_access(sshd:account): list_match: list= ALL, item=user
pam_access(sshd:account): from_match: tok=ALL, item=IP
pam_access(sshd:account): string_match: tok=ALL, item=IP
pam_access(sshd:account): from_match=2, "IP"
pam_access(sshd:account): access denied for user 'user' from 'IP'
I can confirm when listsep=,
specified it's correctly parsing the group "computer managers", but failing to return error codes.
Has anyone experienced this issue?
Are there any work arounds when the groupname contains spaces?
Thanks in advance,
Bhanu
listsep
to something other than whitespace causes theALL
to be tokenized asALL
(with a trailing space) - so thatuser
fails to match the- : ALL : ALL
rule?