I'm trying to setup a ssh server with hardened-gentoo sources openssh (with openssh-lpk, which is the ldap flag on gentoo I think) and selinux enabled.

On the Ldap-Server I have added an user "ldapuser" with a public key. The Login works flawless when selinux is completly disabled.



However when I set selinux is on permissive or enforcing mode the following happens on the client:

ssh -v ldapuser@server
debug1: Entering interactive session.
Write failed: Broken pipe

I see that the public key was accepted.

On the server the only interesting log entry I found was:

server sshd[]: error: ssh_selinux_getctxbyname: Failed to get default SELinux security context for ldapuser

Which makes sense because this user is on the LDAP Server (but pam_ldap and nsswitch.conf is configured properly to use the ldap server).

All reports I found for this Error, https://bugzilla.mindrot.org/show_bug.cgi?id=1325 for example, seem to be closed or not related to my problem.

I'm using Openssh 5.9_p1-r4 with the bindist, hpn, ldap, pam, selinux and tcpd use flags enabled on

Linux server 3.7.4-hardened-r1 #2 SMP Fri Feb 8 13:26:25 CET 2013 x86_64 AMD A4-3300 APU with Radeon(tm) HD Graphics AuthenticAMD GNU/Linux

The question now is: Is this a bug and I should file a bug report or is it a misconfiguration on my part? (I wanted to get slowly into selinux with the permissive mode)


 mediaserv-gentoo ~ # ps -eZ | grep sshd
 kernel                          17017 ?        00:00:01 sshd
 kernel                          25179 ?        00:00:00 sshd

can you show output of

ps -eZ | grep sshd


There is two ways of the problem then:

  • If it's context is different from system - it just need to be started from right context.

  • Alternatively, you just need to create right context for your user.

  • Note that this server has selinux disabled because of this issue, so I don't know it the above output actually helps. Note also that ldapuser is not a user from the system, but a user on the ldap server, so I think there is no context on the system, so the question is how can I specify contexts for external users? – matthid Apr 22 '13 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.