0

I added

auth requisite pam_deny.so

as the first line of every file in /etc/pam.d/ (including sshd), but SSH connections still succeed without a problem. This is on a default Google Cloud Ubuntu instance, so it has some mysterious sort of authentication set up. How can I get my deny command to be applied?

Basic checks

  • /etc/ssh/sshd_config has the line UsePAM yes
  • /etc/ssh/sshd_config has other authentication methods disabled:

    HostbasedAuthentication no
    IgnoreUserKnownHosts yes
    IgnoreRhosts yes
    PasswordAuthentication no
    ChallengeResponseAuthentication no
    KerberosAuthentication no
    GSSAPIAuthentication no
    UseLogin no
    
  • /etc/nsswitch.conf has no custom passwd entries:

    passwd:         compat 
    group:          compat 
    shadow:         compat 
    gshadow:        files 
    
    hosts:          files dns 
    networks:       files 
    
    protocols:      db files 
    services:       db files 
    ethers:         db files 
    rpc:            db files
    
  • restarted sshd service

  • stopped all services with google in the name
  • no hints about auth mechanism in journalctl -f when logging in by SSH
  • OS Login has been deactivated for the Google Cloud project and google_oslogin_control shows its status as deactivated

I log in using a project-wide SSH key configured in Google Cloud project metadata. The instance uses cloud-init to set up SSH keys, etc., but I cannot find any hint as to what might be configured that override PAM's auth mechanism.

Any hint as to what can possibly override PAM's auth mechanism would be greatly appreciated!

N.B. The point of this is to eventually enable a PAM module for two-factor authentication.

2

The deny command is ignored for two separate reasons that correspond to two systems which bypass PAM authentication.

  1. It is ignored when running sudo, because the user is configured with the NOPASSWD flag. This flag is enabled in a file in /etc/sudoers.d that has the line

    %google-sudoers ALL=(ALL:ALL) NOPASSWD:ALL
    

    and my user belongs to the google-sudoers group. As the manual says:

    By default, sudo requires that a user authenticate him or herself before running a command. This behavior can be modified via the NOPASSWD tag.

    So using sudo bypasses authentication (including PAM) altogether.

  2. It is ignored when logging in by SSH using a public key, because SSH public key authentication bypasses PAM. The manual, accessed via man sshd_config on Ubuntu 18.04 says

    If set to yes this will enable PAM authentication using ChallengeResponseAuthentication and PasswordAuthentication in addition to PAM account and session module processing for all authentication types.

    So PAM authentication only works with two types of authentication: challenge response and password. PAM is not used for public key authentication.

    You can force the deny to apply by adding AuthenticationMethods publickey,keyboard-interactive to /etc/sshd_config. This requires the user to authenticate using two methods: first by public key (this will not use PAM) and then by a challenge response (this will use PAM).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.