From owner-freebsd-questions@FreeBSD.ORG Thu Apr 20 22:05:25 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id C10B316A402 for ; Thu, 20 Apr 2006 22:05:25 +0000 (UTC) (envelope-from yontege@hal.rescomp.berkeley.edu) Received: from rescomp.berkeley.edu (keyserver.Rescomp.Berkeley.EDU [169.229.70.167]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7572F43D49 for ; Thu, 20 Apr 2006 22:05:25 +0000 (GMT) (envelope-from yontege@hal.rescomp.berkeley.edu) Received: by rescomp.berkeley.edu (Postfix, from userid 1032) id 505365B775; Thu, 20 Apr 2006 15:05:23 -0700 (PDT) Date: Thu, 20 Apr 2006 15:05:23 -0700 From: "Ian A. Tegebo" To: Gabriel O'Brien Message-ID: <20060420220523.GH21507@rescomp.berkeley.edu> References: <44478640.8090307@quay.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <44478640.8090307@quay.net> User-Agent: Mutt/1.5.9i Cc: freebsd-questions@freebsd.org Subject: Re: PAM/SSH/OPIE configuration without /etc/passwd X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Apr 2006 22:05:25 -0000 On Thu, Apr 20, 2006 at 09:01:52AM -0400, Gabriel O'Brien wrote: > My goal is to have SSH allow authorized_keys and OPIE authentication but > deny all other forms of authentication. Obviously I want authentication > to be denied if the user has neither configured as well. > > # auth > auth required pam_nologin.so no_warn > auth sufficient pam_opie.so no_warn no_fake_prompts > auth requisite pam_opieaccess.so no_warn allow_local I'm looking at the last line there and the pam_opieaccess manpage: --- The pam_opieaccess module is used in conjunction with the pam_opie(8) PAM module to ascertain that authentication can proceed by other means (such as the pam_unix(8) module) even if OPIE authentication failed. --- It looks like that pam_opieaccess.so line might be allowing logins to continue. My thought would be that you should try this: |# auth |auth required pam_nologin.so no_warn |auth sufficient pam_opie.so no_warn no_fake_prompts |auth required pam_ssh.so try_first_pass |auth required pam_deny.so no_warn -- Ian Tegebo