Linux: can only su into a user, no console, no ssh

linuxssh

Got an odd one.

I have a centos box that I've inherited the care of, and all the user accounts appear
to behave as expected with one exception, call it 'weirduser'.

the only way to get to 'weirduser' is to

$  su - weirduser  or
$  su weirduser

and then put in weirduser's password.

I cannot log into weirduser interactively from a console, or from an ssh session using either keypairs or the password.

Other information:

$ grep weird /etc/passwd 
weirduser:x:500:501:weird:/home/weirduser:/bin/bash

]$ ls -ld /home/weirduser
drwxrws--- 21 weirduser weird 4096 Sep 30 17:40 /home/weirduser

$ su - weirduser
Password: 
[weirduser ~]$ id
uid=500(weirduser) gid=501(weird) groups=501(weird)

$ grep -ir osi /etc/pam.d
[weirduser ~]$

There are no AllowUsers or DenyUsers or AllowGroups or DenyGroups in the sshd_config.

Not sure where to go from here. Any suggestions?

Thanks!

Best Answer

Turns out it's configured in a file called /etc/login.block

Thanks to all.

Related Solutions

SSH Tunneling – Only Access

Yes, just use /bin/false as shell and instruct the user to start the tunneling SSH process without executing any remote command (i.e. the -N flag for OpenSSH):

ssh -N -L 1234:target-host:5678 ssh-host

Ssh-agent forwarding and sudo to another user

As you mentioned, the environment variables are removed by sudo, for security reasons.

But fortunately sudo is quite configurable: you can tell it precisely which environment variables you want to keep thanks to the env_keep configuration option in /etc/sudoers.

For agent forwarding, you need to keep the SSH_AUTH_SOCK environment variable. To do so, simply edit your /etc/sudoers configuration file (always using visudo) and set the env_keep option to the appropriate users. If you want this option to be set for all users, use the Defaults line like this:

Defaults    env_keep+=SSH_AUTH_SOCK

man sudoers for more details.

You should now be able to do something like this (provided user1's public key is present in ~/.ssh/authorized_keys in user1@serverA and user2@serverB, and serverA's /etc/sudoers file is setup as indicated above):

user1@mymachine> eval `ssh-agent`  # starts ssh-agent
user1@mymachine> ssh-add           # add user1's key to agent (requires pwd)
user1@mymachine> ssh -A serverA    # no pwd required + agent forwarding activated
user1@serverA> sudo su - user2     # sudo keeps agent forwarding active :-)
user2@serverA> ssh serverB         # goto user2@serverB w/o typing pwd again...
user2@serverB>                     # ...because forwarding still works

Best Answer

Related Solutions

SSH Tunneling – Only Access

Ssh-agent forwarding and sudo to another user

Related Topic