I'm running the same pam_ssh_agent_auth configuration across a number of RH derived systems: Centos7. Centos8 Stream, Centos9 Stream, Fedora.
This configuration works on all of them, except for C9S, and I can't really figure out why.
Installation of the pam_ssh_agent_auth lib, configuration of /etc/pam.d/sudo and /etc/sudoers, creation of users and installation of .../authorized_keys is managed through ansible, and is the same on all of the above.
On C9S, attempting to sudo (as the user sun) results in the below logs:
Jul 17 16:33:33 centos-9-test sudo[56017]: Beginning pam_ssh_agent_auth for user sun
Jul 17 16:33:33 centos-9-test sudo[56017]: Attempting authentication: `sun' as `sun' using /home/sun/.ssh/authorized_keys
Jul 17 16:33:33 centos-9-test sudo[56017]: Contacted ssh-agent of user sun (1000)
Jul 17 16:33:33 centos-9-test sudo[56017]: trying public key file /home/sun/.ssh/authorized_keys
Jul 17 16:33:33 centos-9-test sudo[56017]: auth_secure_filename: checking for uid: 1000
Jul 17 16:33:33 centos-9-test sudo[56017]: secure_filename: checking '/home/sun/.ssh'
Jul 17 16:33:33 centos-9-test sudo[56017]: secure_filename: checking '/home/sun'
Jul 17 16:33:33 centos-9-test sudo[56017]: secure_filename: terminating check at '/home/sun'
Jul 17 16:33:33 centos-9-test sudo[56017]: matching key found: file/command /home/sun/.ssh/authorized_keys, line 1
Jul 17 16:33:33 centos-9-test sudo[56017]: Found matching RSA key: SHA256:pxEsjz3nkAhl8P0sFqpYigo0SL5jtdRcc+CXDzGHNiU
Jul 17 16:33:33 centos-9-test sudo[56017]: Failed Authentication: `sun' as `sun' using /home/sun/.ssh/authorized_keys
Setting a password for the user, and using that to sudo works, so the user is allowed to sudo in general.
In comparison, on all other systems (here a C8S) the same sequence results in these logs:
Jul 17 16:41:48 centos-8-test sudo[24707]: Beginning pam_ssh_agent_auth for user sun
Jul 17 16:41:48 centos-8-test sudo[24707]: Attempting authentication: `sun' as `sun' using /home/sun/.ssh/authorized_keys
Jul 17 16:41:48 centos-8-test sudo[24707]: Contacted ssh-agent of user sun (1000)
Jul 17 16:41:49 centos-8-test sudo[24707]: trying public key file /home/sun/.ssh/authorized_keys
Jul 17 16:41:49 centos-8-test sudo[24707]: auth_secure_filename: checking for uid: 1000
Jul 17 16:41:49 centos-8-test sudo[24707]: secure_filename: checking '/home/sun/.ssh'
Jul 17 16:41:49 centos-8-test sudo[24707]: secure_filename: checking '/home/sun'
Jul 17 16:41:49 centos-8-test sudo[24707]: secure_filename: terminating check at '/home/sun'
Jul 17 16:41:49 centos-8-test sudo[24707]: matching key found: file/command /home/sun/.ssh/authorized_keys, line 1
Jul 17 16:41:49 centos-8-test sudo[24707]: Found matching RSA key: SHA256:pxEsjz3nkAhl8P0sFqpYigo0SL5jtdRcc+CXDzGHNiU
Jul 17 16:41:49 centos-8-test sudo[24707]: Authenticated: `sun' as `sun' using /home/sun/.ssh/authorized_keys
As far as I can tell there's no difference in how pam_ssh_agent_auth is built between the different OSs. Any hint as to where in the code this might go wrong would be appreciated.
I'm running the same pam_ssh_agent_auth configuration across a number of RH derived systems: Centos7. Centos8 Stream, Centos9 Stream, Fedora.
This configuration works on all of them, except for C9S, and I can't really figure out why.
Installation of the pam_ssh_agent_auth lib, configuration of
/etc/pam.d/sudoand/etc/sudoers, creation of users and installation of.../authorized_keysis managed through ansible, and is the same on all of the above.On C9S, attempting to sudo (as the user
sun) results in the below logs:Setting a password for the user, and using that to
sudoworks, so the user is allowed tosudoin general.In comparison, on all other systems (here a C8S) the same sequence results in these logs:
As far as I can tell there's no difference in how pam_ssh_agent_auth is built between the different OSs. Any hint as to where in the code this might go wrong would be appreciated.