Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Got an odd one.

I have a centos box that I've inherited the care of, and all the user accounts appear to behave as expected with one exception, call it 'weirduser'.

the only way to get to 'weirduser' is to

$  su - weirduser  or
$  su weirduser

and then put in weirduser's password.

I cannot log into weirduser interactively from a console, or from an ssh session using either keypairs or the password.

Other information:

$ grep weird /etc/passwd 
weirduser:x:500:501:weird:/home/weirduser:/bin/bash

]$ ls -ld /home/weirduser
drwxrws--- 21 weirduser weird 4096 Sep 30 17:40 /home/weirduser

$ su - weirduser
Password: 
[weirduser ~]$ id
uid=500(weirduser) gid=501(weird) groups=501(weird)

$ grep -ir osi /etc/pam.d
[weirduser ~]$ 

There are no AllowUsers or DenyUsers or AllowGroups or DenyGroups in the sshd_config.

Not sure where to go from here. Any suggestions?

Thanks!

share|improve this question
1  
is there anything in /var/log/secure or /var/log/messages pertaining to that user when you try to log in? –  Zypher Oct 1 '10 at 2:18
1  
any SELinux security policies mentioning that user? –  pjz Oct 1 '10 at 2:24
    
selinux is not enabled on this box. –  user52874 Oct 1 '10 at 2:32
    
from /var/log/secure: Sep 30 18:25:06 mlpdac1 sshd[10684]: Authentication refused: bad ownership or modes for directory /home/osi –  user52874 Oct 1 '10 at 2:34

5 Answers 5

up vote 1 down vote accepted

Turns out it's configured in a file called /etc/login.block

Thanks to all.

share|improve this answer

Is it possible that there are instructions in ~weirduser/.bash_profile that are causing it to logout? You don't offer any details about how it behaves (error messages, timing between steps, etc.) when you try to login from console or SSH. However, I noticed that it has bash for a shell. The man page states that ~/.bash_profile is only used for login shells, which I think means console and SSH but not su.

Check other ~weirduser/.bash* files, while you're at it, too. Look in /etc/profile, too, but that is highly unlikely.

Its just a guess, but its worth checking. If you provide more data about the way in which it fails, I'd be happy to try to come up with more ideas.

Good luck.

share|improve this answer

It appears it doesn't like the setgid on the home directory. Try chmod g-s /home/weirduser

share|improve this answer

Also could you send the permissions of .ssh ? If your permissions are not tough enough usually there is problem with authorized_keys. It doesn't explain the password problem, but it may help.

share|improve this answer

The user's home directory is group-writable. This prevents ssh public key authorization from working (that's what the message Authentication refused: bad ownership or modes for directory /home/osi means). Ssh public key authorization requires ~, ~/.ssh and ~/.ssh/authorized_keys to be writable only by the user (mode 755 or more restrictive).

This doesn't explain why console and ssh with password don't work. What happens when you try to log in: is the password rejected, or is it accepted but then you're dropped back to the login prompt? If the latter, it may be due to some weirdness in the user's profile (/home/osi/.bash_profile or /home/osi/.profile) — although it would have to be quite weird to work with su - but not with a console login.

The user's shell is /bin/bash. Check that /bin/bash is in /etc/shells and that it exists and is executable. Also check that there isn't a spurious CR or other printable character at the end of the line (highly unlikely, but better make sure).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.