SSHd的认证方式改为pam_mysql产生的问题,在线等待求解
因为某些需求,想把ssh的用户认证从系统用户改为通过某个mysql的数据表进行认证。随后进行下列动作:
1.下载pam_mysql,make,cp pam_mysql.so /lib/security/.
2.修改/etc/pam.d/sshd文件如下:
#%PAM-1.0
auth required pam_mysql.so user=test passwd=123456 host=192.168.210.2 db=users table=users usercolumn=username passwdcolumn=password crypt=0 sqllog=0
word crypt=0 sqllog=0
account required pam_mysql.so user=test passwd=123456 host=192.168.210.2 db=users table=users usercolumn=username passwdcolumn=password crypt=0 sqllog=0
#auth sufficient pam_stack.so service=system-auth
auth sufficient pam_unix_auth.so
#account sufficient pam_stack.so service=system-auth
account sufficient pam_unix_acct.so
auth required pam_nologin.so
password required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth
session required pam_limits.so
session optional pam_console.so
3.打开mysql并建立数据库users和表users,执行
GRANT ALL ON users.* TO mysql@"%" IDENTIFIED bY "123456";
insert into users values(NULL,'tester','123456');
4.此时用ssh client连接server,使用用户tester,密码123456,无法登陆
5.查看log,log显示:
Mar 17 13:55:23 game sshd[2567]: Illegal user tester from 192.168.1.92
Mar 17 13:55:26 game sshd[2567]: pam_sm_authenticate called.
Mar 17 13:55:26 game sshd[2567]: dbuser changed.
Mar 17 13:55:26 game sshd[2567]: dbpasswd changed.
Mar 17 13:55:26 game sshd[2567]: host changed.
Mar 17 13:55:26 game sshd[2567]: database changed.
Mar 17 13:55:26 game sshd[2567]: table changed.
Mar 17 13:55:26 game sshd[2567]: usercolumn changed.
Mar 17 13:55:26 game sshd[2567]: passwdcolumn changed.
Mar 17 13:55:26 game sshd[2567]: crypt changed.
Mar 17 13:55:26 game sshd[2567]: sqllog changed.
Mar 17 13:55:26 game sshd[2567]: db_connect called.
Mar 17 13:55:26 game sshd[2567]: returning 0 .
Mar 17 13:55:26 game sshd[2567]: db_checkpasswd called.
Mar 17 13:55:26 game sshd[2567]: pam_mysql: where clause =
Mar 17 13:55:26 game sshd[2567]: SELECT password FROM cts_players WHERE login_id='NOUSER'
Mar 17 13:55:26 game sshd[2567]: pam_mysql: select returned more than one result
Mar 17 13:55:26 game sshd[2567]: returning 7 after db_checkpasswd.
Mar 17 13:55:28 game sshd[2567]: Failed password for illegal user tester from 192.168.1.92 port 1599 ssh2
6.如果在系统用户中添加tester用户之后,pam_mysql的验证能够通过
哪位老大能帮忙解释一下,为什么pam_mysql认证的用户一定要是一个系统用户而不能仅仅是mysql的users里面的一条数据呢?
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(1)
自己定一下!急