Skip to content

PAM loginuid configuration for SSH

PAM loginuid configuration for SSH is a specific adjustment made within the Linux Pluggable Authentication Modules (PAM) subsystem, often encountered when configuring containerized SSH environments (such as Docker containers).

Configuration

The configuration involves modifying the PAM control file for the SSH daemon, typically located at /etc/pam.d/sshd. To alter the behavior, a sed command is frequently used to comment out the line enforcing the pam_loginuid.so module^[600-developer__docker__Dockerfile__docker-ssh.md:16-17].

Example: 

sed -ri 's/session  required   pam_loginuid.so/#session    required  pam_loginuid.so/g' /etc/pam.d/sshd

Purpose

This modification disables the pam_loginuid.so requirement^[600-developer__docker__Dockerfile__docker-ssh.md:16-17]. In environments like Docker, where the process ID (PID) namespace or user namespace may be isolated, the standard loginuid management can fail because the container lacks the necessary privileges or capabilities to write to the kernel's audit loginuid. Commenting out this line prevents SSH login failures caused by these permission restrictions.

Sources

  • 600-developer__docker__Dockerfile__docker-ssh.md