Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled.

On the Ldap-Server I have added an user "ldapuser" with a public key. The Login works flawless when selinux is completly disabled.

/etc/selinux/config

SELINUX=disabled

However when I set selinux is on permissive or enforcing mode the following happens on the client:

ssh -v ldapuser@server
debug1: Entering interactive session.
Write failed: Broken pipe

I see that the public key was accepted.

On the server the only interesting log entry I found was:

server sshd[]: error: ssh_selinux_getctxbyname: Failed to get default SELinux security context for ldapuser

Which makes sense because this user is on the LDAP Server (but pam_ldap and nsswitch.conf is configured properly to use the ldap server).

All reports I found for this Error, https://bugzilla.mindrot.org/show_bug.cgi?id=1325 for example, seem to be closed or not related to my problem.

I'm using Openssh 5.9_p1-r4 with the bindist, hpn, ldap, pam, selinux and tcpd use flags enabled on

Linux server 3.7.4-hardened-r1 #2 SMP Fri Feb 8 13:26:25 CET 2013 x86_64 AMD A4-3300 APU with Radeon(tm) HD Graphics AuthenticAMD GNU/Linux

The question now is: Is this a bug and I should file a bug report or is it a misconfiguration on my part? (I wanted to get slowly into selinux with the permissive mode)

Edit:

 mediaserv-gentoo ~ # ps -eZ | grep sshd
 kernel                          17017 ?        00:00:01 sshd
 kernel                          25179 ?        00:00:00 sshd
share|improve this question

1 Answer 1

can you show output of

ps -eZ | grep sshd

?

There is two ways of the problem then:

  • If it's context is different from system - it just need to be started from right context.

  • Alternatively, you just need to create right context for your user.

share|improve this answer
    
Note that this server has selinux disabled because of this issue, so I don't know it the above output actually helps. Note also that ldapuser is not a user from the system, but a user on the ldap server, so I think there is no context on the system, so the question is how can I specify contexts for external users? –  reddragon Apr 22 '13 at 18:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.