I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled.
On the Ldap-Server I have added an user "ldapuser" with a public key. The Login works flawless when selinux is completly disabled.
However when I set selinux is on permissive or enforcing mode the following happens on the client:
ssh -v ldapuser@server debug1: Entering interactive session. Write failed: Broken pipe
I see that the public key was accepted.
On the server the only interesting log entry I found was:
server sshd: error: ssh_selinux_getctxbyname: Failed to get default SELinux security context for ldapuser
Which makes sense because this user is on the LDAP Server (but pam_ldap and nsswitch.conf is configured properly to use the ldap server).
All reports I found for this Error, https://bugzilla.mindrot.org/show_bug.cgi?id=1325 for example, seem to be closed or not related to my problem.
I'm using Openssh 5.9_p1-r4 with the bindist, hpn, ldap, pam, selinux and tcpd use flags enabled on
Linux server 3.7.4-hardened-r1 #2 SMP Fri Feb 8 13:26:25 CET 2013 x86_64 AMD A4-3300 APU with Radeon(tm) HD Graphics AuthenticAMD GNU/Linux
The question now is: Is this a bug and I should file a bug report or is it a misconfiguration on my part? (I wanted to get slowly into selinux with the permissive mode)
mediaserv-gentoo ~ # ps -eZ | grep sshd kernel 17017 ? 00:00:01 sshd kernel 25179 ? 00:00:00 sshd