I'm setting up a SELinux-based server, which I have done numerous times,
but for some reason I cannot get OpenSSH to set the correct user
contexts for staff logins.
Note that logins work fine at the console, so this is definitely an
OpenSSH problem. However, I've checked everything I can think of any
nothing is set wrong.
I have added myself as an SELinux login associated with the staff_u
user, and indeed when I log in at the console it puts me into staff_r
I've added myself as an SELinux login associated with staff_u:
Login Name SELinux User
__default__ user_u
kutulu staff_u
root root
system_u system_u
But when I log in via ssh, I'm in the user_r role, and sestatus gives me
this:
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: permissive
Mode from config file: permissive
Policy version: 21
Policy from config file: strict
Process contexts:
Current context: user_u:user_r:user_t
Init context: system_u:system_r:init_t
/sbin/agetty system_u:system_r:getty_t
/usr/sbin/sshd system_u:system_r:sshd_t
File contexts:
Controlling term: user_u:object_r:user_devpts_t
/sbin/init system_u:object_r:init_exec_t
/sbin/agetty system_u:object_r:getty_exec_t
/bin/login system_u:object_r:login_exec_t
/sbin/rc system_u:object_r:initrc_exec_t
/sbin/runscript.sh system_u:object_r:initrc_exec_t
/usr/sbin/sshd system_u:object_r:sshd_exec_t
/usr/sbin/unix_chkpwd system_u:object_r:chkpwd_exec_t
/etc/passwd system_u:object_r:etc_t
/etc/shadow system_u:object_r:shadow_t
/bin/sh system_u:object_r:bin_t ->
system_u:object_r:shell_exec_t
/bin/bash system_u:object_r:shell_exec_t
/usr/bin/newrole system_u:object_r:newrole_exec_t
/lib/libc.so.6 system_u:object_r:lib_t ->
system_u:object_r:shlib_t
/lib/ld-linux.so.2 system_u:object_r:lib_t ->
system_u:object_r:ld_so_t
I get no errors from ssh itself that would indicate an inability to get
the user context, and no audit messages that would indicate that
something went wrong with SELinux. I dunno what else to check. Can
anyone help me out here?
--Mike
--
[EMAIL PROTECTED] mailing list
