What am I missing?

[Craig1f]

I've got everything working, but I'm down to two problems:

If I tail /var/log/secure, I get this: /usr/local/bin/keymaker-create-account-for-iam-user failed: exit code 2

If I modify that file and set $PAM_USER to $1, and then call the file from the command line, it works fine. When it's being called via PAM Module, it fails. No idea what is wired incorrectly for PAM_USER.

2. If I've already set the user using the hack above, and I tail /var/log/secure again, I get: error: AuthorizedKeysCommand /usr/sbin/keymaker-get-public-keys returned status 22

If I paste my public key into the file and echo it, my user authenticates just fine. If I call this file directly from the command line, it gives me back the authorized_keys I expect. If I remove 'get_authorized_keys "$@"' I get the expected keymaker help menu. If I just do "keymaker get_authorized_keys" without the "$@", I get nothing. It seems to be behaving really weird when I try to call keymaker with any arguments. It doesn't return the authorized_keys, so the user doesn't get authenticated.

This is all on CentOS 7.3

[kislyuk]

Hello, sorry for the late response to this issue.

The scripts /usr/local/bin/keymaker-create-account-for-iam-user and /usr/sbin/keymaker-get-public-keys are not meant to be called directly.

The first script is called by the PAM authentication stack when trying to log in the user. The currently released version of keymaker incorrectly raises errors in keymaker-create-account-for-iam-user even when the process succeeds. It's safe to disregard these errors. You can check whether the process succeeded or not by trying to log in with a user with a name corresponding to an IAM user name, but no local user account. If the account is created after trying to log in, then the script is working fine.

Your second issue means that /usr/sbin/keymaker-get-public-keys failed to retrieve the keys for the user. This script is called by sshd when trying to log in the user. The failure to retrieve keys can happen because you did not upload the user's public key with keymaker upload, the IAM role for your instance doesn't have read access to the IAM user object, or the instance has no network access to the IAM API. (I do need to figure out a better way for these processes to log their errors).

[kislyuk]

Closing due to lack of response. Please reopen if you are still having difficulties.