ssh public key auth "Remote login for account is not allowed" ?

UNIX AIX
1

Hello,

Using AIX 6.1 boxes.
User user1 connects from box A to box B using ssh.
When password authentication is used everything is fine. When I configure user1 to use public key authentication sftp client works fine(no password asked), but ssh client fails. This is sshd log:

Accepted publickey for user1 from A port 46607 ssh2
Disconnecting: Remote login for account user1 is not allowed.

To my understanding ssh authentication passes fine - something else in the way. I've done identical configs on linux boxes with no problems.
This is something AIX specific.

Any ideas ?

thnaks
Vilius

2

stumbled upon this bug which notes there is a "rlogin=false" setting AIX can enforce on certain users.

2 Likes
3

Ok thanks - rlogin user attribute was what I was looking for.

Vilius

1 Like
4

If your user is only going to be using SFTP and not require access to your box via SSH, you can set their "shell" to "/usr/sbin/sftp-server". The /usr/sbin/sftp-server is part of the SSH fileset included with AIX I believe. I've done this for quite a few users who will never login via SSH, they are just allowed to upload code. It even supports SSH key authentication. It isn't a big deal but it makes your box better secured.

Also, if you do decide to use it, make sure "/usr/sbin/sftp-server" is included on the "shells = ..." line in your /etc/security/login.cfg file, otherwise, it won't work.