From owner-freebsd-questions@freebsd.org Tue Mar 24 23:52:25 2020 Return-Path: Delivered-To: freebsd-questions@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 2E05826E6A9 for ; Tue, 24 Mar 2020 23:52:25 +0000 (UTC) (envelope-from dave.mehler@gmail.com) Received: from mail-io1-xd2a.google.com (mail-io1-xd2a.google.com [IPv6:2607:f8b0:4864:20::d2a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1O1" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 48n7MZ18hMz4RTs for ; Tue, 24 Mar 2020 23:52:09 +0000 (UTC) (envelope-from dave.mehler@gmail.com) Received: by mail-io1-xd2a.google.com with SMTP id v3so446195iot.11 for ; Tue, 24 Mar 2020 16:52:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=k2sIAxAFTPe9KqJLAjwJdDn9b/TMwZN05YiNoGUNGIQ=; b=egmuJRFmL8BJT5T4Wddo618Z2YRsXK+05q3j4MVjx317dLqjkEuSp/DnsnIvgmOppM +PsxwUkQWbGdX4PdyHqbmCMdibGYLTj7cb+AFzabF2A/VRnZgxzWdJShKzlMgdqprexU /7neDQD3q4lSKEblXM2eP5HYHwHTOs7x8otu9n69PAd+Yr7511xxQjxAIPM6CoYyGdQh HKRQrFzf+exU3HCMJOeUNwrB1gzLj/ehud86dEhB/V7iNkbpb9GfxKJJMpTiRsXn+AX/ bxsbJwWxL5QcZjoklwXnWExTqzlxFmaQsjSmmrs+GqqpVMb1ESB+PbuPTXCwlxG0pAJm MaFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=k2sIAxAFTPe9KqJLAjwJdDn9b/TMwZN05YiNoGUNGIQ=; b=DxU+lO1xNYnX8Q0yUcMxpzByGcGVk+XiQTI+G/FLHMGvMF76wdFqAuwSvaJndi9E+c B/4AgbCuNKqaTo/k6QdTRAS7gxgPUgqlwuhWOGfeyd8X0Ne4ShLRNYHDoPuKoJ/pDtY7 3SYCdoHjIyEnEV5XQiZS2nGSwsgKPF+M1Nh3xp3oMi8w9IcBJEmUlYGjonBnVfTvQXAi Iem1+Oz5miYA3hP3MgA6+e2IAHh2T60vrtdGRYzcWMj8Ksc1AtYIgmcigmA61Y26NLg9 zcukSTTKWLu01snQuX4xI3BAG9KV9dA6orATW+mB+wmgeb533hHGlq0n3vZptAP+mPE2 lSeg== X-Gm-Message-State: ANhLgQ3jAUMcq6tEC/t5lHEqYXGn40S1vSslFe80blxcC69B7AbGI45K dGryD8NXE9Y2LIG6UJU2lgO/8vM0mP7WvaMcQn3ppk66 X-Google-Smtp-Source: ADFU+vuUcfnuNGL2LozVGpAkwDTyHeo5v6EmkQCSSg7MzexWbcZzzbU9hSi0ktnhYI+Au6I8Owd1VebtTI4qkOWGGyI= X-Received: by 2002:a5d:878c:: with SMTP id f12mr515767ion.164.1585093920479; Tue, 24 Mar 2020 16:52:00 -0700 (PDT) MIME-Version: 1.0 Received: by 2002:a4f:8487:0:0:0:0:0 with HTTP; Tue, 24 Mar 2020 16:52:00 -0700 (PDT) From: David Mehler Date: Tue, 24 Mar 2020 19:52:00 -0400 Message-ID: Subject: sshd not allowing a subgroup to authenticate according to it's authentication method To: freebsd-questions Content-Type: text/plain; charset="UTF-8" X-Rspamd-Queue-Id: 48n7MZ18hMz4RTs X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20161025 header.b=egmuJRFm; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (mx1.freebsd.org: domain of davemehler@gmail.com designates 2607:f8b0:4864:20::d2a as permitted sender) smtp.mailfrom=davemehler@gmail.com X-Spamd-Result: default: False [-3.00 / 15.00]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20161025]; FROM_HAS_DN(0.00)[]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36]; FREEMAIL_FROM(0.00)[gmail.com]; MIME_GOOD(-0.10)[text/plain]; PREVIOUSLY_DELIVERED(0.00)[freebsd-questions@freebsd.org]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; RCVD_COUNT_TWO(0.00)[2]; RCPT_COUNT_ONE(0.00)[1]; IP_SCORE_FREEMAIL(0.00)[]; IP_SCORE(0.00)[ip: (-6.59), ipnet: 2607:f8b0::/32(-0.38), asn: 15169(-0.48), country: US(-0.05)]; TO_DN_ALL(0.00)[]; DKIM_TRACE(0.00)[gmail.com:+]; DMARC_POLICY_ALLOW(-0.50)[gmail.com,none]; RCVD_IN_DNSWL_NONE(0.00)[a.2.d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.4.6.8.4.0.b.8.f.7.0.6.2.list.dnswl.org : 127.0.5.0]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; FREEMAIL_ENVFROM(0.00)[gmail.com]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; TAGGED_FROM(0.00)[]; RCVD_TLS_ALL(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com.dwl.dnswl.org : 127.0.5.0] X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 24 Mar 2020 23:52:25 -0000 Hello, I'm running sshd on FreeBSD 12.1. I'm having an issue, I want users in a group sftpusers to be able to be logged in via password and to be chrooted to their home directories. Everytime I try to log in I'm getting no supported authenticationmethods publickey. From the man page I thought that a group definition overrode a global configuration setting. Here's a config snipet: # Authentication: AuthenticationMethods publickey #StrictModes yes #PubkeyAuthentication yes #PasswordAuthentication no #PermitEmptyPasswords no ChallengeResponseAuthentication no UsePAM no AllowAgentForwarding no AllowTcpForwarding no #GatewayPorts no #ChrootDirectory none Subsystem sftp internal-sftp # Set up groups for different types of logins AllowGroups sshusers sftpusers Match Group sshusers PubkeyAuthentication yes PasswordAuthentication no X11Forwarding no AllowTcpForwarding no AllowAgentForwarding no PermitTunnel no Match Group sftpusers ChrootDirectory /home/%u ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding no AllowAgentForwarding no PermitTunnel no PermitTTY no PasswordAuthentication yes Suggestions welcome. Thanks. Dave.