How to make PAM give a message when denying ssh access

brobeck · 10-23-2009, 03:24 PM

We use PAM to control access to our RHEL4 servers. We would like PAM to give a message, of our choice, when users who are not allowed to login try to login. PAM's default is to let the user try 3 times without any explanation.

unSpawn · 10-23-2009, 04:43 PM

Quote:

Originally Posted by brobeck

We would like PAM to give a message, of our choice, when users who are not allowed to login try to login.

In some organizations it is required to present a banner or trespass notice before login (pam_issue, pam_echo, /etc/issue, sshd_config Banner, 'man 5 hosts_access') basically telling you to stay away. I think that's the best generic way without giving away information. I'm sure you have your requirements but giving away information unnecessarily is bad. Giving explicit confirmation to not-yet-authenticated-users about account existence or access restrictions is doubleplusbad.

brobeck · 10-23-2009, 05:49 PM

I agree, but let's say I would like to do tell the user "You are not allowed to login to this server". How would I go about doing this in PAM?

unSpawn · 10-23-2009, 06:12 PM

You don't. At least not as a response and not configurable per user.

anomie · 10-23-2009, 06:36 PM

Quote:

Originally Posted by brobeck

I agree, but let's say I would like to do tell the user "You are not allowed to login to this server". How would I go about doing this in PAM?

Not to sidestep the question, but I'd argue that failed authentication and a nice "Permission denied (keyboard-interactive)" message says exactly that.

Couple that with an sshd banner clearly stating appropriate access terms, and only the dimmest of bulbs won't be able to get the picture.

fpmurphy · 10-25-2009, 09:23 AM

Quote:

I agree, but let's say I would like to do tell the user "You are not allowed to login to this server". How would I go about doing this in PAM?

Use pam_echo to output the required message

vikas027 · 10-25-2009, 10:29 AM

Quote:

Originally Posted by fpmurphy

Use pam_echo to output the required message

Hi fpmurphy,

Could you please tell where to put pam_echo and if possible syntax also pls.

chrism01 · 10-25-2009, 08:09 PM

This may help http://www.kernel.org/pub/linux/libs...x-PAM_SAG.html