Currently, I am configuring LDAP client for user authentication on the server. Only SSH key authentication is allowed (Password authentication is not allowed).
My SSH configurtion (/etc/ssh/sshd_config)
PermitRootLogin no
AuthorizedKeysCommand /path/to/getsshkey.sh
AuthorizedKeysCommandUser root
PasswordAuthentication no
My other config files:
I have added following line in /etc/pam.d/common-auth
auth required pam_access.so
I have added the following line in /etc/pam.d/sshd
account required pam_access.so
I have added the following line in /etc/security/access.conf
-: ALL EXCEPT root (group1) (group2): ALL except LOCAL
I have also configured all these files (/etc/ldap.conf, /etc/nsswitch.conf, /etc/pam.d/common-session)
For an example username1 belong to group1
when I execute this command
ssh -i private.pem username1@ip_address
I get below error in auth.log on the server
Access denied for user username1 by PAM account configuration [preauth]
Why is access denied?
Please help me
ALL except LOCAL
denies all logins except local ones. SSH is not local login. – Jakuje Mar 20 '16 at 9:38