3

I have a really strange problem with my macOS Sierra Server. It is connected to the Active Directory server and limited access to the login window only for few people. This is working without any problem. (Really only these users are allowed to login on mac server with their domain credentials)

Now I activated SSH because I need this for GIT repositories. I gave the domain user access rights on using ssh but I always get "Permission denied" when I try to connect. If I use a local account it works.

In the logs I only can find:

com.openssh.sshd.... Service exited with abnormal status code 255
com.openssh.sshd.... Service exited with abnormal status code 1

Do you have any idea whats going wrong here?

Improve this question
5
  • I tried to reproduce your AD environment in a more less vanilla AD + OS X environment: I created a global AD group SSH-Users and added some arbitrary AD users. In OS X I added this network group in macOS' Sharing PrefPane > Remote Login > Only these users > + > Network Groups > SSH-Users and it works. Maybe you have to add some details (e.g. ssh_conf)
    – klanomath
    Commented Dec 4, 2016 at 1:03
  • I will check your test without the server app. I don't know if there is a difference. Which syntax of username are you using when logging into ssh?
    – Bene
    Commented Dec 6, 2016 at 7:18
  • Simply username@hostname (with username member of a global AD group SSH-Users and hostname as well as the ssh client's host members of the standard AD Computers group). I didn't install Server.app though and no "golden triangle" setup (AD & OD) here. I may repeat it with Server.app installed.
    – klanomath
    Commented Dec 6, 2016 at 10:53
  • @klanomath yes your solution works when I have a new mac os system without mac server app. Did you try it with server app? Is it still working?
    – Bene
    Commented Dec 6, 2016 at 12:45
  • It also works with Server.app 5.2 installed. If I try to connect from 10.11 to 10.12 with one of my arbitrary SSH-Users (domainsshuser) - a user who never logged on to the 10.11 / 10.12 hosts, I get the error Could not chdir to home directory /Users/domainsshuser: No such file or directory of course..
    – klanomath
    Commented Dec 6, 2016 at 13:24

2 Answers 2

Reset to default
1
+50

Your question is hard to answer because it would need more details, AD and OS X configuration details as well as Group Policy settings.

In a new Active Directory environment with some joined OS X clients and an OS X server, the set up works as expected.

After creating a global security group SSH-OSXUsers and adding some arbitrary AD users one has to add this network group in macOS' Sharing PrefPane > Remote Login > Only these users > + > Network Groups > SSH-OSXUsers (or in the respective settings in Server.app).

To connect to this server I recommend to use ssh user@hostname or ssh user@fqdn. With a proper PTR record for the OS X server in the reverse DNS tree, it should also work with the IP.

Connecting with a user of the SSH-OSXUsers group who never logged on to the server host, you will get the error Could not chdir to home directory /Users/domainsshuser: No such file or directory because the user's home folder is missing, but you can execute commands.

If you connect with a managed network account or a mobile account user with a home folder on the server host you won't see this message.

One step to get a more detailed ssh error message may be changing the standard error path from /dev/null to /tmp/ssh.stderr in the launch daemon after disabling SIP.

Improve this answer
0

Have you checked if the AD users have a shell appointed? Without a shell users can never ssh into the mac.

Using dscl you can read the 'UserShell'. That is not defined in AD and normally mapped to /bin/bash.

For local accounts the command is dscl . list /Users UserShell, for AD you should use something like this dscl . list /Active\ Directory/domain/All\ Domains/Users UserShell but I have no AD available to check my syntax.

You should get a full list of all users with this command but I cannot check dscl localhost list /Search/Users UserShell

If the shell is not defined for AD users, fix this. In GUI: Directory Utility - Active Directory, Advanced - User Experience in cli: dsconfigad (the command dsconfigad -show can show current setup)

Edit: and check for group access to ssh (default only for specific users) in server.app.

Improve this answer
3
  • I just tried to list all users but unfortunately my testaccount is not displayed with /bin/bash... I now have two mac sierras (one with server app one without) but the one without server app works as expected. Both servers do not display the used user account with /bin/bash but number two works while number one doesn't. I am trying to reinstall the server app on the second one as @klanomath suggested but behind a firewall this is a little bit tricky...
    – Bene
    Commented Dec 8, 2016 at 7:42
  • "unfortunately my testaccount is not displayed with /bin/bash..." that looks like your issue. I guess that the server app has different settings when binding to AD (maybe on purpose since normally you do not want all AD users to be able to use ssh)
    – Maurits
    Commented Dec 8, 2016 at 7:50
  • Ok it works when I do not install the server.app 5.2. I now just installed it and the ssh access is not working any longer... what the hell is this app doing?
    – Bene
    Commented Dec 8, 2016 at 8:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .