1 |
>>>> My backup user needs a shell on the backup server in order to execute |
2 |
>>>> rsync and needs to be included in /etc/ssh/sshd_config AllowUsers in |
3 |
>>>> order to SSH in. My authorized_keys file is locked-down. The second |
4 |
>>>> field for the user in /etc/shadow is an exclamation point which I |
5 |
>>>> think means the user can not log in with a password. Should I take |
6 |
>>>> any additional steps to prevent that user from logging in and not |
7 |
>>>> being subject to the authorized_keys restrictions? |
8 |
>>> |
9 |
>>> What about "PasswordAuthentication no"? |
10 |
>> |
11 |
>> Can that be set for a single user? I have a normal user who needs to |
12 |
>> log in via SSH with a password and a backup user who only needs to run |
13 |
>> rsync via SSH keys. If not, does the exclamation point in /etc/shadow |
14 |
>> prevent the user from logging in without the SSH key? |
15 |
> |
16 |
> Depends. |
17 |
> |
18 |
> The user doesn't have a Unix password, so if the system prompts for one |
19 |
> it cannot succeed and the login fails. |
20 |
> |
21 |
> But sshd has other implementations for authentication to, not just |
22 |
> classic Unix. If it uses PAM, then PAM could in theory do anything, even |
23 |
> using AD to authenticate with a password. |
24 |
> |
25 |
> So if your sshd config uses Unix passwords and keys ONLY (this is the |
26 |
> norm), then what you describe above does what you want. To be sure, you |
27 |
> need to audit sshd_config and your pam setup |
28 |
|
29 |
Here is my entire sshd_config: |
30 |
|
31 |
PasswordAuthentication no |
32 |
UsePAM yes |
33 |
PrintMotd no |
34 |
PrintLastLog no |
35 |
Subsystem sftp /usr/lib64/misc/sftp-server |
36 |
AllowUsers user1 user2 |
37 |
|
38 |
That must be the Gentoo-default except for the last line, correct? |
39 |
How is this config if I want user1 to login with a password and user2 |
40 |
has no password in /etc/shadow and automatically logs in via |
41 |
authorized_keys to rsync? |
42 |
|
43 |
- Grant |