Restrict service account from direct interactive sessions
Environment: CentOS 7
I would like to have a solution where a service account can access a server in only these ways:
ssh non-interactively via password or ssh key; that is, run commands or scripts (but running anything in /etc/shells will not be allowed)
not ssh interactively
regular users can su $serviceaccount or otherwise get an interactive shell
The purpose is to make users log in to the server as themselves, and then switch user, but also to allow the service account to interact with itself through scripted processes from other servers.
I have tried these steps already
sshd_config no ttys
/etc/ssh/sshd_config:
Code:
Match User $serviceaccount
PermitTTY no
This one actually does nothing except prevent a nice-looking terminal. The user still gets an interactive shell.
/sbin/nologin: prevents all logins, except "sudo -su $serviceaccount"
/bin/false: fails out entirely
/bin/true: does not allow any activity at all
custom wrapper script: A custom script that checks for "$@" and reacts to it might be my only choice and I will continue experimentation. But it could get weird for the local users who su $serviceaccount.
restrict logins from certain IPs (the other servers who are using the service account)
Users could just get a shell over there, and ssh in directly to an interactive shell.
In conclusion
I am interested in any and all attempts to meet the goals described above: Paid solutions, free solutions, hacky shell scripts, ssh config customization, custom default shells, wrapper scripts, etc. I would be pleased to see even partial answers, and I can bang away on adding the missing portions.
Is what I'm aiming for reasonable, or even possible?
Looks unreasonably complex to implement yes, with requests for functionality overlapping.
Is there another approach for desired outcome ?
Perhaps some web server and actual application....
You will have many issues with implementing your entire functionality using one user and SSH protocol.
If you manage to do that in the end you will have a hacky mess.
Perhaps more service users with separated privileges.
Linux and unix systems are multi user environments in their essence, so exploit that as much as you can.
I started a possible tool to watch the logs and deal with shell sessions, but it can be easily defeated with a ssh remoteserver /bin/bash.
Code:
#!/bin/sh
# startdate: 2018-10-05 13:20
# Purpose: if a service account user logs in interactively, then kill it.
# incomplete. Can be foiled with: ssh -t clonetest210 /bin/bash
# improve: how to retrieve log entries to check
# Sample journalctl output.
# Oct 05 13:12:52 clonetest210 sshd[1868]: Starting session: shell on pts/3 for bgstack15-local from 10.200.18.240 port 59349 id 0
# Dependencies: sshd_config LogLevel VERBOSE
# journalctl -f -u sshd is not sufficient. I cannot tell what unit logs the notice seen above.
BADUSERS="(bgstack15-local|prophetess)"
journalctl -n100 | grep -oE "sshd\[.{1,10}\]: Starting session: shell on .* for ${BADUSERS} from .*" | awk '{print $1,$6,$8,$10}' | while read longpid tty tu srcip ;
do
pid="$( echo "${longpid}" | tr -dc "[:digit:]" )"
echo "Found login: ${tu} from pid ${pid} from ip ${srcip} and made terminal ${tty}"
# investigate that current pid. if it exists and is sshd, kill it
psout="$( ps -e -o pid:9,ppid:9,user:15,command:90 2>/dev/null | awk "\$1 == $pid" )"
if test -n "${psout}" && echo "${psout}" | grep -qE "sshd:" ;
then
echo "need to warn user ${tu} on tty ${tty} and then kill pid ${pid}"
printf "\n%s\n" "Interactive sessions are not allowed for user ${tu}." > "/dev/${tty}"
sleep 0
kill "${pid}"
fi
done
I have Windows AD server and all of the linux computers are joined to AD.
Recently, 2FA has been activated, I wish to exclude some of the domain service accounts from 2FA
# less /etc/pam_radius_acl.conf
sshd:*
# /etc/pam.d/sshd
auth required pam_sepermit.so
auth requisite... (0 Replies)
Hello,
I would like to confirm whether the below procedure is correct.
disabled direct super user access on AIX server using below procedure. Please let me know if there is any additional step.
1) confirm the access to HMC, console to reach the LPARs
2) chuser rlogin=false root
... (3 Replies)
Hi Everyone,
I want to know is it possible, restrict user login to AIX by IP and user name?
e.g.
user alice can login to AIX (via ssh or telnet) from 192.168.1.100
user alice can not login to AIX (via ssh or telnet) from 172.16.1.100
user bob can not login to AIX (via ssh or telnet)... (6 Replies)
Hello experts,
Is it possible to have an user account on RHEL 6.3 as a su-only account, but with ssh capability and no interactive login? Let me elaborate.
Say, we have a cluster of 5 RHEL 6.3 servers and an user account (strmadmin) on each of the server as an su-only... (1 Reply)
Hi guys,
been scratching round the forums and my mountain of resources.
Maybe I havn't read deep enough
My question is not how sed edits a stream and outputs it to a file, rather something like this below:
I have a .txt with some text in it :rolleyes:
abc:123:xyz
123:abc:987... (7 Replies)
Hey
Is there any way to differentiate if a user is logged directly into a UNIX functional account or if they have scsu'ed into the functional account?
Cheers
Paul (2 Replies)
Q. Write a script that behaves both in interactive and non interactive mode. When no arguments are supplied it picks up each C program from the directory and prints first 10 lines.
It then prompts for deletion of the file.
If user supplies arguments with the script , then it works on those files... (8 Replies)
Q. Write a script that behaves both in interactive and non interactive mode. When no arguments are supplied it picks up each C program from the directory and prints first 10 lines.
It then prompts for deletion of the file.
If user supplies arguments with the script , then it works on those files... (1 Reply)
Our users have the tendency to use only one login account, to do their jobs. Obvious itīs a matter of training our users. But our internal audit team insists on restrictions from our system.
So is there an option to restrict an account to only login once into the system?
We use HP-UX 11.0.
... (0 Replies)
