Difference between revisions of "Howto HostAuth"

From Linux-VServer

Jump to: navigation, search
(Clarified what's going on based on my own experience)
(Installation Instructions)
 
(9 intermediate revisions by 6 users not shown)
Line 1: Line 1:
 
== What is this? ==
 
== What is this? ==
  
This is PAM host-auth module for linux-vserver powered systems.
+
nss_vserver is a nss authentication module for linux-vserver powered systems which allows processes running on the host (sshd, getty) to authenticate users that exist on guests.
  
The nss_vserver module allows processes running on the host (sshd, getty) to authenticate users that exist on guests.
+
The module should almost transparently drop in to a modern Linux system: PAM would call its pam_unix module, which would in turn look through the nss modules to complete the process.
  
 
If you want to complete the guest login process, you should also get a modified version of vslogin linked to below. vslogin will pick up after authentication and deliver the user to a shell on his guest.
 
If you want to complete the guest login process, you should also get a modified version of vslogin linked to below. vslogin will pick up after authentication and deliver the user to a shell on his guest.
Line 9: Line 9:
 
Note that with nss_vserver you don't need the syncshadows included in the vserverauth tarball.
 
Note that with nss_vserver you don't need the syncshadows included in the vserverauth tarball.
  
== Installation Instructions ==
+
== Why would I use it? ==
  
On linux, just run
+
Using nss_vserver and vslogin you could run a single instance of sshd on the host. This host-based server would verify the credentials of a user on a guest and then vslogin would take care of presenting the user a guest-based shell.
  
<code>
+
== Installation Instructions ==
  
make install
+
1. Get the appropriate version. On x86 versions you need to use the pthread version, on amd64 (and possible x86_64) you need the cthreads version (listed as nss_vserver_64). Also, on amd64 it's in /lib/, not in /lib/tls/.
  
</code>
+
2. On linux, just run
 +
make install
  
After, try to run
+
* Note: on recent kernels test passes, but you unable to login via ssh. To fix that problem:
  
<code>
+
2.1. edit /etc/nsswitch.conf, remove "vserver" from "group:" line
  
make test
+
2.2. Add into /etc/group line "vserver:x:9999:"
 
+
</code>
+
  
 +
3. After, try to run
 +
make test
 
To see if it works.
 
To see if it works.
  
Line 33: Line 34:
 
Just run
 
Just run
  
<code>
+
make uninstall
 
+
make uninstall
+
 
+
</code>
+
  
 
== Use with vslogin ==
 
== Use with vslogin ==
  
 
After you have installed module, (and have vslogin copied to /sbin/ and suid-root) you are ready: try to login into a guest, say one named "test" with user "user", by loggin in into the host with username "test-user" or "user@test." You should find yourself logged into the guest.
 
After you have installed module, (and have vslogin copied to /sbin/ and suid-root) you are ready: try to login into a guest, say one named "test" with user "user", by loggin in into the host with username "test-user" or "user@test." You should find yourself logged into the guest.
 +
 +
Note: vslogin requires vservers root too be at /vservers, so make it as symlink to your location. For example, for debian systems need to do
 +
ln -s var/lib/vservers /vservers
  
 
== Caveats ==
 
== Caveats ==
Line 62: Line 62:
  
 
nss_vserver: http://dev.call2ru.com/vs/nss_vserver.tar.bz2
 
nss_vserver: http://dev.call2ru.com/vs/nss_vserver.tar.bz2
 +
 +
nss_vserver_64 (for use on 64bit systems): http://dev.call2ru.com/vs/nss_vserver_64.tar.bz2
  
 
modified vslogin: http://dev.call2ru.com/vs/vserverauth.tar.gz
 
modified vslogin: http://dev.call2ru.com/vs/vserverauth.tar.gz
Line 70: Line 72:
  
 
vslogin was written by Alec Thomas (http://swapoff.org/LinuxVServer)
 
vslogin was written by Alec Thomas (http://swapoff.org/LinuxVServer)
 +
 +
== Troubleshooting ==
 +
 +
vslogin:chroot: No such file or directory
 +
indicates that vslogin can't access the vserver set in the GECOS field (i.e. you possibly have a typo in the GECOS field).
 +
 +
[[Category:HowTo]]

Latest revision as of 14:31, 19 July 2009

Contents

[edit] What is this?

nss_vserver is a nss authentication module for linux-vserver powered systems which allows processes running on the host (sshd, getty) to authenticate users that exist on guests.

The module should almost transparently drop in to a modern Linux system: PAM would call its pam_unix module, which would in turn look through the nss modules to complete the process.

If you want to complete the guest login process, you should also get a modified version of vslogin linked to below. vslogin will pick up after authentication and deliver the user to a shell on his guest.

Note that with nss_vserver you don't need the syncshadows included in the vserverauth tarball.

[edit] Why would I use it?

Using nss_vserver and vslogin you could run a single instance of sshd on the host. This host-based server would verify the credentials of a user on a guest and then vslogin would take care of presenting the user a guest-based shell.

[edit] Installation Instructions

1. Get the appropriate version. On x86 versions you need to use the pthread version, on amd64 (and possible x86_64) you need the cthreads version (listed as nss_vserver_64). Also, on amd64 it's in /lib/, not in /lib/tls/.

2. On linux, just run

make install
  • Note: on recent kernels test passes, but you unable to login via ssh. To fix that problem:

2.1. edit /etc/nsswitch.conf, remove "vserver" from "group:" line

2.2. Add into /etc/group line "vserver:x:9999:"

3. After, try to run

make test

To see if it works.

[edit] How to remove it from system?

Just run

make uninstall

[edit] Use with vslogin

After you have installed module, (and have vslogin copied to /sbin/ and suid-root) you are ready: try to login into a guest, say one named "test" with user "user", by loggin in into the host with username "test-user" or "user@test." You should find yourself logged into the guest.

Note: vslogin requires vservers root too be at /vservers, so make it as symlink to your location. For example, for debian systems need to do

ln -s var/lib/vservers /vservers

[edit] Caveats

[edit] Security

WARNING! If you have installed vslogin, NEVER give shell access to your host to users -- any user on host, who able to execute programs and modify environment will be able to log into guests as anybody he wants!

[edit] Usernames and guest names with dashes

Avoid using usernames or guest names with dashes.

The current version only tries one configuration while searching for the user in guest databases, which can cause problems:

  • User "user" on guest "ser-ver" when written as "user@ser-ver" will work fine, while "ser-ver-user" will be threated as user "ver-user" on vserver "ser".
  • User "us-er" on guest "server" when written as "guest-us-er" will work fine, while "us-er@guest" will be threated as user "er@guest" on vserver "us".

If you must have dashes, use the syncshadows method instead.

[edit] Download links

nss_vserver: http://dev.call2ru.com/vs/nss_vserver.tar.bz2

nss_vserver_64 (for use on 64bit systems): http://dev.call2ru.com/vs/nss_vserver_64.tar.bz2

modified vslogin: http://dev.call2ru.com/vs/vserverauth.tar.gz

[edit] Authors and copyright

nss_vserver was written by Anton Fedorov <datacompboy@call2ru.com> 19 march 2006 and is public domain; feel free to use it as you want.

vslogin was written by Alec Thomas (http://swapoff.org/LinuxVServer)

[edit] Troubleshooting

vslogin:chroot: No such file or directory

indicates that vslogin can't access the vserver set in the GECOS field (i.e. you possibly have a typo in the GECOS field).

Personal tools