I have many users in my environment who deploy their public keys on the linux servers for password-less and secure login via SSH.

All these users have accounts on our Active Directory, however, when a user leaves the company and we disable her corresponding AD account, her keys are still there and she can still login to all servers that have her public keys deployed.

Is there any way I can prevent the user from logging in to a server via her public key when her AD account is disabled, locked, expired or deleted?

Note: We use PBIS-Open for AD authentication

  • You've told us very little about how this is all configured (whether you have UsePam=Yes in your opensshd config and the corresponding PAM stack might be helpful) – symcbean Dec 24 '17 at 17:20
  • I can use a whole new configuration, doesn't matter. – SoCRaT Dec 25 '17 at 10:02

You can set the user shell to /sbin/nologin, it might be also a different path depending on the distribution and version.

usermod --shell /sbin/nologin <user-name>

Additionally you can set the expire date as well.

usermod --shell /sbin/nologin --expiredate 1 <user-name>

Depending on your configuration, these information might also be configured in LDAP, NIS or directly in AD. In those cases you might have to execute some different commands to alter the login shell and the expiration date.

| improve this answer | |
  • /bin/false is another common "no login allowed" shell, although it could allow SFTP depending on your configuration. Either way, check /etc/shells for an appropriate "no login" shell or add one as needed. – ivanivan Dec 24 '17 at 17:57
  • but how would I know which servers have the user's keys installed? – SoCRaT Dec 25 '17 at 10:03
  • Well, if you do not have a centralized authentication like LDAP, best would be to configure the login shell on each server to disable the login. – Thomas Dec 25 '17 at 10:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.