auth requisite pam_deny.so
as the first line of every file in
sshd), but SSH connections still succeed without a problem. This is on a default Google Cloud Ubuntu instance, so it has some mysterious sort of authentication set up. How can I get my deny command to be applied?
/etc/ssh/sshd_confighas the line
/etc/ssh/sshd_confighas other authentication methods disabled:
HostbasedAuthentication no IgnoreUserKnownHosts yes IgnoreRhosts yes PasswordAuthentication no ChallengeResponseAuthentication no KerberosAuthentication no GSSAPIAuthentication no UseLogin no
/etc/nsswitch.confhas no custom
passwd: compat group: compat shadow: compat gshadow: files hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files
- stopped all services with
- no hints about auth mechanism in
journalctl -fwhen logging in by SSH
- OS Login has been deactivated for the Google Cloud project and
google_oslogin_controlshows its status as
I log in using a project-wide SSH key configured in Google Cloud project metadata. The instance uses
cloud-init to set up SSH keys, etc., but I cannot find any hint as to what might be configured that override PAM's auth mechanism.
Any hint as to what can possibly override PAM's auth mechanism would be greatly appreciated!
N.B. The point of this is to eventually enable a PAM module for two-factor authentication.