Ssh not allowing NIS user to login


 
Thread Tools Search this Thread
Operating Systems AIX Ssh not allowing NIS user to login
# 1  
Old 09-20-2016
Ssh not allowing NIS user to login

As I do a ssh <nis_user>@server1 from server2, ssh prompts for certificates (as expected the first time), then it prompts for the users password, as soon as I enter the password, I get a Connection to server1 closed by remote host, and connection to server1 closed. and I disconnect back to the originating host.

Both hosts are AIX 6.1 TL7 SP10 servers.
OpenSSH 6.0.0.6102 on both servers.

I can telnet to server1 and enter nis_user and password and login just fine, but, when I try to use the @server1 login method, I get disconnected. The problem follows the nis_user. I created local /etc/passwd accounts and they work fine. My NIS user account works fine between the 2 systems.

Seems to follow only the one specific user and between these 2 servers. Other AIX 6.1 and 7.1 servers have no issue with the same user. No special settings in ssh_config or sshd_config on either host.

One for the ages!
# 2  
Old 09-20-2016
are you logging auth messages via to syslog? What message do you see there on auth failure?
# 3  
Old 09-20-2016
Code:
Sep 20 15:35:02 server1 auth|security:info sshd[10354864]: Accepted password for nis_user from 10.41.80.8 port 41888 ssh2
Sep 20 15:35:02 server1 auth|security:crit sshd[13959322]: fatal: permanently_set_uid: was able to restore old [e]gid

dang, had totally forgotten about auth.log. Thanks

did a quick look through google and nothing in /etc/group and no local user account for nis_user. There was a mention of a getpwid patch but if it was OS, then why does my other 3 AIX boxes work without issue. Same nis server for all 5 boxes.

Code:
server1:>oslevel -s
 6100-07-10-1415

---------- Post updated at 03:47 PM ---------- Previous update was at 02:52 PM ----------

Fixed the problem.
The issue is there is a bug in openssh where if there is a /etc/group --> GID_NAME and if the LDAP or NIS user has a same GID_NAME, but different value you will get this inability to login via ssh.
the corrective action is to make the /etc/group --> GID_NAME value the same as the naming service value, or delete the local GID_NAME.


Moderator's Comments:
Mod Comment Please use CODE tags as required by forum rules!

Last edited by RudiC; 09-21-2016 at 07:03 AM.. Reason: Added CODE tags.
# 4  
Old 09-21-2016
Thanks for sharing the solution!
I wonder if there is a bug in the libc.
The gid -> gname order should be identical with the gname -> gid order, regardless which method (+: entry or nsswitch.conf) is used.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

Ssh public/private key user login problem

I have a user account configuration with ssh public/private key that works on multiple servers centos and rhel. One server (Server F) that is not working in centos 6.8. When i ssh into server f I get prompted for a password. I have verified the config and it all is good. I put sshd into debug... (8 Replies)
Discussion started by: bash_in_my_head
8 Replies

2. UNIX for Advanced & Expert Users

One user to su to another without allowing root access and password

Hello Gurus, I want One user to su to another without allowing root access and password. I want to run a specific command as below from user am663: --------------------------------------------------------- sudo -u appsprj4 /home/appsrj4/scripts/start_apache.sh ------------------- But... (6 Replies)
Discussion started by: pokhraj_d
6 Replies

3. Solaris

How can i setup ssh password-less login for particular user?

HI Community. I was trying to create ssh password less authentication for one user called night and it's not working for me. These are the steps I followed:- I have logged into the server and issued ssh-ketgen -t rsabash-3.2$ ssh-keygen -t rsa Generating public/private rsa key pair.... (4 Replies)
Discussion started by: bentech4u
4 Replies

4. Red Hat

SFTP user include/exclude without preventing SSH login

I have been asked to see if we can restrict SFTP access to authorised users only. There will be business users who will log on with SSH, but they are locked into a menu. They will have write access to the production data to do their job, but we don't want them to have access to read/write the... (8 Replies)
Discussion started by: rbatte1
8 Replies

5. Shell Programming and Scripting

AIX pam ssh/sshd configuration not allowing sed or awk

This is a weird problem. Following is my code. /opt/quest/bin/vastool configure pam sshd /opt/quest/bin/vastool configure pam ssh cat /etc/pam.conf | \ awk '$1=="ssh"||$1=="sshd"||$1=="emagent"{sub("prohibit","aix",$NF);}1' OFS='\t' > /etc/pam.conf cat /etc/ssh/sshd_config | \ sed -e... (2 Replies)
Discussion started by: pjeedu2247
2 Replies

6. HP-UX

Suppress SSH login logs of a user

Hi, I want to suppress ssh login logs of a particular user to get logged in /var/adm/syslog/syslog.log As am using a user to monitor a server over ssh in 5 miute interval..and that creating un-necessary logs in my syslog.log file .. Please help me if there any way I can suppress this logs only... (6 Replies)
Discussion started by: Shirishlnx
6 Replies

7. Shell Programming and Scripting

Help to hide shell terminal and run prompt program after ssh login for specified user

Hey guys, I have some task from my office to lock user on the specified directory after the user logged on using ssh. And then run prompt program to fill the required information. Yeah, just like an ATM system. My question: How could I do those?? AFAIK I have to edit the ~./bashrc. But the... (1 Reply)
Discussion started by: franzramadhan
1 Replies

8. UNIX for Dummies Questions & Answers

$USER is not set in remsh but works fine via ssh login

1) ssh a@b echo $USER it display the correct value as a (even though i have not defined it in .profile) 2) remsh b -l a echo $USER it does not display the value as a (variable is not set any idea why $USER variable is not initialized when i login via remsh or rlogin but shows the... (10 Replies)
Discussion started by: reldb
10 Replies

9. Shell Programming and Scripting

SSH login with user name and script.

I want to login to server using ssh or telnet and execute one command then exit to the shell Please let me know how to write script for this? (1 Reply)
Discussion started by: svenkatareddy
1 Replies

10. HP-UX

User not able to login directly using ssh

HI, We are facing a problem while trying to login using ssh. The user is able to login using telnet. We are able to login as another user using ssh and then su to that user which is successfull. What should i be checking for the user to be able to login directly using ssh. Thanks in... (2 Replies)
Discussion started by: sag71155
2 Replies
Login or Register to Ask a Question