[CentOS] pam_access not working?

[Will McDonald]

On 30/11/06, Morten Kjeldgaard <mok at bioxray.dk> wrote:
>
> Big thanks to Barry Brimer and Will McDonald for your suggestions!

No problem.

> I had big hopes for the "UsePAM  yes" in sshd_config since I was not
> aware of that option, and it seemed like THE solution. However, tried
> it, restarted the sshd daemon but still the same, I can still log on.
> Totally strange.

I've just had a play on a test system and I seem to have it working.

[root at server ~]# grep -v ^# /etc/ssh/sshd_config

Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
SyslogFacility AUTHPRIV
PermitRootLogin without-password
StrictModes yes
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys
IgnoreRhosts yes
PasswordAuthentication no
UsePAM yes
LogLevel DEBUG
X11Forwarding yes
Subsystem       sftp    /usr/libexec/openssh/sftp-server

[root at server ~]# grep -v ^# /etc/security/access.conf

[root at server ~]# grep -v ^# /etc/pam.d/system-auth
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/pam_access.so
account     required      /lib/security/$ISA/pam_unix.so
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account     required      /lib/security/$ISA/pam_permit.so

password    requisite     /lib/security/$ISA/pam_cracklib.so retry=3
password    sufficient    /lib/security/$ISA/pam_unix.so nullok
use_authtok md5 shadow
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so

So that's nothing in access.conf, all I've added in system-auth is
"account     required      /lib/security/pam_access.so" as in your
example, though that was a default setup which has more that yours
appears to.

The sshd_config is tailored by my Kickstart and from that I've added

UsePAM yes
LogLevel DEBUG

You don't want to run with LogLevel DEBUG under normal circumstances.

Note, the man page states you need either PasswordAuthentication or
ChallengeResponseAuthentication disabled, too.

[user at client ~]$ ssh -ltestuser 192.168.24.112
Password:
Last login: Thu Nov 30 14:11:58 2006 from client
[testuser at server ~]$ exit
Connection to 192.168.24.112 closed.

That's me authed and connected, which that SSH configuration typically
wouldn't have allowed without PAM enabled since its keys-only.

Now add an entry into access.conf.

[root at server ~]# grep -v ^# /etc/security/access.conf
-:testuser:ALL

[user at client ~]$ ssh -ltestuser 192.168.24.112
Password:
Password:
Password:
Permission denied (publickey,keyboard-interactive).