Forum Discussion

TK_45015's avatar
TK_45015
Icon for Nimbostratus rankNimbostratus
Feb 08, 2012

ssh public key auth with tacacs+ enabled

Hi Gurus!     I have configured tacacs+ authentication in LTM box that is running 10.2 software - works like a charm. But I have also configured one local account and trying to get ssh public ke...
management
monitoring
Andy_Litzinger's avatar
Andy_Litzinger
Did this change in 10.2? I was able to login with a local user via public key auth and with tacacs+ defined while i was running 10.1. yesterday i upgraded to 10.2.3 and I'm getting the same errors in my /var/log/secure logs as TK:

 

 

Feb 28 10:20:17 local/MY-BIGIP crit sshd[13317]: fatal: Access denied for user my_user by PAM account configuration

 

 

it seems like there should be an update you can make to /config/bigip/pam.d/sshd to allow this to work? or maybe someplace else?
alois_2269's avatar
alois_2269
Icon for Nimbostratus rankNimbostratus
Nov 10, 2016

I have the same error. Tried the documentation:

 

https://support.f5.com/kb/en-us/solutions/public/13000/400/sol13454.htmlbigipsshdaccept

 

But did not carefully read the prerequisites:

 

You must meet the following prerequisites to use this procedure:

 

  • You are familiar with SSH protocol
  • You are familiar with the vi text editor
  • Your BIG-IP system is configured to use the local user directory for system authentication

I tried following procedures:

 

  • Switch off the remote authenticaton -> ssh-key auth works :-)
  • turn on remote authentication -> ssh-key auth does not work anymore :-(

Any suggestions ? Seems no local auth will work if remote-auth is running/configured.