#4508 No proper error messege for new user interested in fedorapeople and planet
Closed: Fixed None Opened 9 years ago by pravins.

= bug description =

One new joinee reported me this issue.
$ssh username@fedorapeople.org
Error Publickey denied

= bug analysis =
I checked .ssh keys, those were proper.

While searching on other sites, found new user must be subscribe to one more group other than cla

= fix recommendation =
This is really confusing specifically for new users. Error report itself should mention to get sponsorship for other group than cla

some reference for an issue https://ask.fedoraproject.org/en/question/41422/permission-denied-public-key-error-when-trying-to-connect-using-ssh-key/


The error message you are reporting is the standard/default error message generated by openssh, I do not know if there is a way for us to personalize it

Note that the instructions regarding the use of fedorapeople: https://fedoraproject.org/wiki/Infrastructure/fedorapeople.org start with:
{{{
1. You need an active Fedora account
2. You must be sponsored in a group (other than the CLA groups)
}}}

Fare enough.
Thank you closing.

For me it usually looks like this (on a local system):

{{{
[robert@tux ~]$ ssh tux@192.168.122.9
This account is currently not available.
Connection to 192.168.122.9 closed.
[robert@tux ~]$
}}}

If I replace /sbin/nologin as shell for the given user by a script named /sbin/nologin-reason with the content like this

{{{

!/bin/sh

echo "You must be subscribed to one more group other than 'cla' to use this service!"
exit
}}}

it finally looks like this:

{{{
[robert@tux ~]$ ssh tux@192.168.122.9
You must be subscribed to one more group other than 'cla' to use this service!
Connection to 192.168.122.9 closed.
[robert@tux ~]$
}}}

However this requires an existing system user (no idea if this is the case at Fedora infrastructure).

There are only accounts for valid users on the machine so that will not work.

Perhaps we could do something with the sshd_config "Banner" option? It sends that before auth, so we could always have it say a bit of text that you must be in at least one non cla group?

ok. I have setup a banner.

{{{
% ssh fedorapeople.org -l nonexistant
This system is for Fedora Contributors only!

You must be in at least one non cla group to have access.

See: https://fedoraproject.org/wiki/Infrastructure/fedorapeople.org

Permission denied (publickey).
}}}

Hopefully that helps. ;)

Login to comment on this ticket.

Metadata