create an account - Githubissues

hirokomatsui commented 4 years ago

Can you create a restricted account like gaulton with the user name gaowei. Only on flh1 (or flh2) will be fine. Thank you!

hirokomatsui commented 4 years ago

Also can you remove gaulton as well as his home directory.

tatarsky commented 4 years ago

Yes and Yes. One moment.

tatarsky commented 4 years ago

Steps just in case becomes regular item:

useradd -s /sbin/nologin -d /frazer01/home/gaowei -g 100 gaowei
chown root: ~gaowei
mkdir ~gaowei/upload
chown gaowei: ~gaowei/upload

Remember they need to cd into "upload" now due to security enhancements in chroot sshd.

Edit /etc/ssh/sshd_config

Match User gaowei
    ChrootDirectory /frazer01/home/gaowei
    AllowTCPForwarding no
    X11Forwarding no
    ForceCommand internal-sftp

Set a password:

passwd gaowei

Wait for puppet to propagate. (Forced it) Tested upload. Emailed you password.

tatarsky commented 4 years ago

Oh and I made it available on both flh1 and flh2....removing gaulton

hirokomatsui commented 4 years ago

Thanks!

tatarsky commented 4 years ago

No prob! Just advise if issues!

hirokomatsui commented 4 years ago

We have to get him to upload the data again. So I re-created the user account. I did delete the user once:

userdel gaowei

Then add the user as you described above: useradd -s /sbin/nologin -d /frazer01/home/gaowei -g 100 gaowei chown root: ~gaowei mkdir ~gaowei/upload chown gaowei: ~gaowei/upload

But I cannot log in as him:

sftp gaowei@flh1.ucsd.edu:/upload gaowei@flh1.ucsd.edu's password: Connected to flh1.ucsd.edu. File "/upload" not found.

Can you check. I set the password, H4ZPYXgNxA

tatarsky commented 4 years ago

Try now. My umask may be more permissive than yours.

I added:

chmod 755 ~gaowei

It was 700.

To the above and appears to work. I believe as ssh drops privs it still has to be able to reference the chroot directory. 755 permissions allow that.

hirokomatsui commented 4 years ago

It works. Thanks!

hirokomatsui commented 4 years ago

Sorry, some how I never be able to create a user. I created a new user, gaulton, as the same way above, and am getting this message:

$ sftp gaulton@flh1.ucsd.edu:/upload gaulton@flh1.ucsd.edu's password: Received message too long 1416128883

The password is k0vsykQmam in the case. Thanks!

tatarsky commented 4 years ago

You were close. You just needed to restart sshd.

That message is a long standing "weird" SFTP output that results from login echo'ing some characters. In this case because sshd was not restarted. the attempt at login hits /sbin/nologin instead of a shell:

This account is currently not available.

Which gets turned into that crazy error ;)

sftp re-tested after sshd restarted (service sshd restart) and works ok!

hirokomatsui commented 4 years ago

Got it, thanks!

hirokomatsui commented 3 years ago

For some reason, I've never been able to create user accounts myself. I created a user account, josh, on flh1 exactly same as before for gaulton, and cannot log in as josh.

bash-4.2$ sftp josh@flh1.ucsd.edu:/upload josh@flh1.ucsd.edu's password: packet_write_wait: Connection to 169.228.63.174 port 22: Broken pipe Couldn't read packet: Connection reset by peer

Do you have any idea? The password is viW6fGdiun