2

Got an odd one.

I have a centos box that I've inherited the care of, and all the user accounts appear to behave as expected with one exception, call it 'weirduser'.

the only way to get to 'weirduser' is to

$  su - weirduser  or
$  su weirduser

and then put in weirduser's password.

I cannot log into weirduser interactively from a console, or from an ssh session using either keypairs or the password.

Other information:

$ grep weird /etc/passwd 
weirduser:x:500:501:weird:/home/weirduser:/bin/bash

]$ ls -ld /home/weirduser
drwxrws--- 21 weirduser weird 4096 Sep 30 17:40 /home/weirduser

$ su - weirduser
Password: 
[weirduser ~]$ id
uid=500(weirduser) gid=501(weird) groups=501(weird)

$ grep -ir osi /etc/pam.d
[weirduser ~]$ 

There are no AllowUsers or DenyUsers or AllowGroups or DenyGroups in the sshd_config.

Not sure where to go from here. Any suggestions?

Thanks!

4
  • 1
    is there anything in /var/log/secure or /var/log/messages pertaining to that user when you try to log in?
    – Zypher
    Oct 1, 2010 at 2:18
  • 1
    any SELinux security policies mentioning that user?
    – pjz
    Oct 1, 2010 at 2:24
  • selinux is not enabled on this box.
    – user52874
    Oct 1, 2010 at 2:32
  • from /var/log/secure: Sep 30 18:25:06 mlpdac1 sshd[10684]: Authentication refused: bad ownership or modes for directory /home/osi
    – user52874
    Oct 1, 2010 at 2:34

5 Answers 5

1

Turns out it's configured in a file called /etc/login.block

Thanks to all.

0

Is it possible that there are instructions in ~weirduser/.bash_profile that are causing it to logout? You don't offer any details about how it behaves (error messages, timing between steps, etc.) when you try to login from console or SSH. However, I noticed that it has bash for a shell. The man page states that ~/.bash_profile is only used for login shells, which I think means console and SSH but not su.

Check other ~weirduser/.bash* files, while you're at it, too. Look in /etc/profile, too, but that is highly unlikely.

Its just a guess, but its worth checking. If you provide more data about the way in which it fails, I'd be happy to try to come up with more ideas.

Good luck.

0

It appears it doesn't like the setgid on the home directory. Try chmod g-s /home/weirduser

0

Also could you send the permissions of .ssh ? If your permissions are not tough enough usually there is problem with authorized_keys. It doesn't explain the password problem, but it may help.

0

The user's home directory is group-writable. This prevents ssh public key authorization from working (that's what the message Authentication refused: bad ownership or modes for directory /home/osi means). Ssh public key authorization requires ~, ~/.ssh and ~/.ssh/authorized_keys to be writable only by the user (mode 755 or more restrictive).

This doesn't explain why console and ssh with password don't work. What happens when you try to log in: is the password rejected, or is it accepted but then you're dropped back to the login prompt? If the latter, it may be due to some weirdness in the user's profile (/home/osi/.bash_profile or /home/osi/.profile) — although it would have to be quite weird to work with su - but not with a console login.

The user's shell is /bin/bash. Check that /bin/bash is in /etc/shells and that it exists and is executable. Also check that there isn't a spurious CR or other printable character at the end of the line (highly unlikely, but better make sure).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .