0

Need to use AD for user authentication in Linux servers, while keeping only a limited (1-2) local users. AD authentication is done through the Kerberos. pam.d file configuration as follows

cat /etc/pam.d/password-auth-ssh 

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_krb5.so try_first_pass 
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so

cat /etc/pam.d/sshd 

#%PAM-1.0
auth       include      password-auth-ssh
account    required     pam_nologin.so
account    include      password-auth-ssh
password   include      password-auth-ssh
session    optional     pam_keyinit.so force revoke
session    include      password-auth-ssh
session    required     pam_loginuid.so
Phill W.
  • 1,479
  • 7
  • 7
Prabath Lasantha
  • 1
  • Please reformat your text. And the question is missing. BTW why do you do that manually? There are tools to do that for you which do stuff correctly. What is your Linux distribution? BTW you have to have `GSSAPIAuthentication yes` in `sshd_config`. – Jiri B Mar 08 '21 at 10:01
  • @JiriB this is the existing config file I want to edit this as per above mention requirement "Need to use AD for user authentication in Linux servers, while keeping only a limited (1-2) local users" – linux distro is RHEL 7 # GSSAPI options GSSAPIAuthentication yes GSSAPICleanupCredentials no #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no #GSSAPIEnablek5users no – Prabath Lasantha Mar 08 '21 at 16:31
  • There's still missing the question itself. What is your problem? Anyway, kerberos works with tickets, you completely missed info about service (sshd) keytab, you also missed info about how do you get entries (passwd/group) via NSS. If you want a review than you should show all details. I really recommend to follow official doc https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/windows_integration_guide/adding-linux-to-ad It's easier to configured SSSD and it's easy to misconfigure PAM. – Jiri B Mar 08 '21 at 18:01
  • @JiriB actually requirement is to allow AD authentication and only 1-2 local users should be able to log in via ssh . I'm trying to do it by editing pam.d file. but I don't have any idea to do it. Please suggest me to do it by editing pam.d file – Prabath Lasantha Mar 09 '21 at 00:53
  • @JiriB if you have any idea please let me know – Prabath Lasantha Mar 09 '21 at 05:23

0 Answers0