SSH With Domain Account

[Fabio Rodrigues]

Hello,

My FreeNAS is in the domain (at least in the UI) but I would like to know if it is possible to SSH to the FreeNAS server with a domain account.

Thanks.

 

[Ericloewe]

Should be. Public key authentication might require more setup that defeats the whole domain idea, but password authentication should work.

 

[Fabio Rodrigues]

Should be. Public key authentication might require more setup that defeats the whole domain idea, but password authentication should work.

Thanks. Should I configure anything in the UI or in a config file to be able to login with a domain account? I'm getting "Access denied" error message.

 

[Ericloewe]

Maybe SSH access is disabled.

 

[Fabio Rodrigues]

Maybe SSH access is disabled.

It is not, the service is running, I just unchecked "Login as root with password" option.

 

[Ericloewe]

It is not, the service is running, I just unchecked "Login as root with password" option.

I meant the users. I think I remember SSH access being an option in the user configuration. You'll have to set it to activated, if I'm right. If you need to do so for more than a handful of users, you'll want to automate it with the FreeNAS API.

 

[Fabio Rodrigues]

I meant the users. I think I remember SSH access being an option in the user configuration. You'll have to set it to activated, if I'm right. If you need to do so for more than a handful of users, you'll want to automate it with the FreeNAS API.

But the users listed in the "User" configuration are all local users, not domain users.

 

[anodos]

Try checking the box "Use Default Domain" under "Directory Service" -> "Active Directory". Then try SSHing in using your username. I.e., if the domain username is "FOO\bob", then ssh bob@ip.of.server

 

[Fabio Rodrigues]

Try checking the box "Use Default Domain" under "Directory Service" -> "Active Directory". Then try SSHing in using your username. I.e., if the domain username is "FOO\bob", then ssh bob@ip.of.server

Great, it works! Now if I want to restrict SSH to some domain users or groups only, what should I do?

 

[anodos]

Great, it works! Now if I want to restrict SSH to some domain users or groups only, what should I do?

Go to "services" -> "SSH" and add the following line under "Extra Options"

Code:

AllowUsers bob larry
AllowGroups Domain\ Admins Stooges

Where "bob" and "larry" are users, and "Domain Admins" and "Stooges" are groups.

 

[Fabio Rodrigues]

Go to "services" -> "SSH" and add the following line under "Extra Options"

Code:

AllowUsers bob larry
AllowGroups Domain\ Admins Stooges

Where "bob" and "larry" are users, and "Domain Admins" and "Stooges" are groups.

Perfect, thanks a lot!

 

[Fabio Rodrigues]

Go to "services" -> "SSH" and add the following line under "Extra Options"

Code:

AllowUsers bob larry
AllowGroups Domain\ Admins Stooges

Where "bob" and "larry" are users, and "Domain Admins" and "Stooges" are groups.

I'm trying to allow two groups, "Domain Admins" and "Linux Admins". Is it correct?

AllowGroups Domain^Admins Linux^Admins

Or should be:

AllowGroups Domain\ Admins Linux\ Admins

 

[Fabio Rodrigues]

I'm trying to allow two groups, "Domain Admins" and "Linux Admins". Is it correct?

AllowGroups Domain^Admins Linux^Admins

Or should be:

AllowGroups Domain\ Admins Linux\ Admins

I'm member of both groups but I'm getting "access denied". I tried both ways.

 

[anodos]

I'm member of both groups but I'm getting "access denied". I tried both ways.

AllowGroups "Domain Admins" "Linux Admins"

I can't ever remember the syntax for handling spaces in config files.

 

[Fabio Rodrigues]

AllowGroups "Domain Admins" "Linux Admins"

I can't ever remember the syntax for handling spaces in config files.

Still failing... I tried:

AllowGroups Linux\ Admins
AllowGroups "Linux Admins"
AllowGroups Linux^Admins

I restarted the SSH service and also rebooted the server, no success.

 

[anodos]

Still failing... I tried:

AllowGroups Linux\ Admins
AllowGroups "Linux Admins"
AllowGroups Linux^Admins

I restarted the SSH service and also rebooted the server, no success.

Try creating an AD group that does not have a space, then test authentication. For instance "LinuxAdmins" instead of "Linux Admins".