Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled.

On the Ldap-Server I have added an user "ldapuser" with a public key. The Login works flawless when selinux is completly disabled.



However when I set selinux is on permissive or enforcing mode the following happens on the client:

ssh -v ldapuser@server
debug1: Entering interactive session.
Write failed: Broken pipe

I see that the public key was accepted.

On the server the only interesting log entry I found was:

server sshd[]: error: ssh_selinux_getctxbyname: Failed to get default SELinux security context for ldapuser

Which makes sense because this user is on the LDAP Server (but pam_ldap and nsswitch.conf is configured properly to use the ldap server).

All reports I found for this Error, for example, seem to be closed or not related to my problem.

I'm using Openssh 5.9_p1-r4 with the bindist, hpn, ldap, pam, selinux and tcpd use flags enabled on

Linux server 3.7.4-hardened-r1 #2 SMP Fri Feb 8 13:26:25 CET 2013 x86_64 AMD A4-3300 APU with Radeon(tm) HD Graphics AuthenticAMD GNU/Linux

The question now is: Is this a bug and I should file a bug report or is it a misconfiguration on my part? (I wanted to get slowly into selinux with the permissive mode)


 mediaserv-gentoo ~ # ps -eZ | grep sshd
 kernel                          17017 ?        00:00:01 sshd
 kernel                          25179 ?        00:00:00 sshd
share|improve this question

can you show output of

ps -eZ | grep sshd


There is two ways of the problem then:

  • If it's context is different from system - it just need to be started from right context.

  • Alternatively, you just need to create right context for your user.

share|improve this answer
Note that this server has selinux disabled because of this issue, so I don't know it the above output actually helps. Note also that ldapuser is not a user from the system, but a user on the ldap server, so I think there is no context on the system, so the question is how can I specify contexts for external users? – matthid Apr 22 '13 at 18:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.