Howto HostAuth
What is this?[edit]
nss_vserver is a nss authentication module for linux-vserver powered systems which allows processes running on the host (sshd, getty) to authenticate users that exist on guests.
The module should almost transparently drop in to a modern Linux system: PAM would call its pam_unix module, which would in turn look through the nss modules to complete the process.
If you want to complete the guest login process, you should also get a modified version of vslogin linked to below. vslogin will pick up after authentication and deliver the user to a shell on his guest.
Note that with nss_vserver you don't need the syncshadows included in the vserverauth tarball.
Why would I use it?[edit]
Using nss_vserver and vslogin you could run a single instance of sshd on the host. This host-based server would verify the credentials of a user on a guest and then vslogin would take care of presenting the user a guest-based shell.
Installation Instructions[edit]
1. Get the appropriate version. On x86 versions you need to use the pthread version, on amd64 (and possible x86_64) you need the cthreads version (listed as nss_vserver_64). Also, on amd64 it's in /lib/, not in /lib/tls/.
2. On linux, just run
make install
- Note: on recent kernels test passes, but you unable to login via ssh. To fix that problem:
2.1. edit /etc/nsswitch.conf, remove "vserver" from "group:" line
2.2. Add into /etc/group line "vserver:x:9999:"
3. After, try to run
make test
To see if it works.
How to remove it from system?[edit]
Just run
make uninstall
Use with vslogin[edit]
After you have installed module, (and have vslogin copied to /sbin/ and suid-root) you are ready: try to login into a guest, say one named "test" with user "user", by loggin in into the host with username "test-user" or "user@test." You should find yourself logged into the guest.
Note: vslogin requires vservers root too be at /vservers, so make it as symlink to your location. For example, for debian systems need to do
ln -s var/lib/vservers /vservers
Caveats[edit]
Security[edit]
WARNING! If you have installed vslogin, NEVER give shell access to your host to users -- any user on host, who able to execute programs and modify environment will be able to log into guests as anybody he wants!
Usernames and guest names with dashes[edit]
Avoid using usernames or guest names with dashes.
The current version only tries one configuration while searching for the user in guest databases, which can cause problems:
- User "user" on guest "ser-ver" when written as "user@ser-ver" will work fine, while "ser-ver-user" will be threated as user "ver-user" on vserver "ser".
- User "us-er" on guest "server" when written as "guest-us-er" will work fine, while "us-er@guest" will be threated as user "er@guest" on vserver "us".
If you must have dashes, use the syncshadows method instead.
Download links[edit]
nss_vserver: http://dev.call2ru.com/vs/nss_vserver.tar.bz2
nss_vserver_64 (for use on 64bit systems): http://dev.call2ru.com/vs/nss_vserver_64.tar.bz2
modified vslogin: http://dev.call2ru.com/vs/vserverauth.tar.gz
Authors and copyright[edit]
nss_vserver was written by Anton Fedorov <datacompboy@call2ru.com> 19 march 2006 and is public domain; feel free to use it as you want.
vslogin was written by Alec Thomas (http://swapoff.org/LinuxVServer)
Troubleshooting[edit]
vslogin:chroot: No such file or directory
indicates that vslogin can't access the vserver set in the GECOS field (i.e. you possibly have a typo in the GECOS field).