New users created - cant log in

michmoor

I was toying aorund with the Negate Nexus service trying to get that up and running when i received alerts that my back up system (oxidized) was failing. It is due to the oxidized account unable to log-in.

Checking the /etc/passwd file i did notice that the account is suddenly set to 'nologin'. As a test, any new account i create is set to 'nologin'. In the GUI, they are set to log in which is the default.

Whats going on here?

admin:*:0:0:System Administrator:/root:/etc/rc.initial
oxidized:*:2012:65534::/home/oxidized:/sbin/nologin
test111:*:2013:65534::/home/test111:/sbin/nologin
[25.07.1-RELEASE][admin@atl-fw1-inet.moore.lan]/root:

SteveITS

@michmoor I think that's normal for additional users. Per https://docs.netgate.com/pfsense/en/latest/recipes/ssh-access.html#user-access "Additional users with limited access may be granted the User - System - Shell account access privilege to login via SSH."

michmoor

@SteveITS said in New users created - cant log in:

https://docs.netgate.com/pfsense/en/latest/recipes/ssh-access.html#user-access

This was working..
so where do i grant the user the ability to log-in ?

There isnt a System -> User -> Shell
There also an ability to provide shell access to a user under the users account.

SteveITS

@michmoor Edit the user, and in the "Effective Privileges" section, click Add, to get to:

michmoor

This post is deleted!

michmoor

@SteveITS that.........did it.

I am so confused right now.

I have another pfsense firewall thats able to be backed up Checking that account on that firewall

oxidized:*:2000:65534::/home/oxidized:/bin/tcsh

Only with this lab firewall did i have to specifically grant SSH access. Super strange. But its working for now

michmoor

I do wonder if this is some pfnet weirdness. Now that i am able to view diffs, the only change made today was disabling Nexus.
In any case, appreciate your help @SteveITS as always.

marcosm

The behavior should be the same regardless of Nexus running. The "nologin" part will be there if the user is not part of the admins group - in which case it needs to be part of a group with the correct privilege (or the privilege added to the user itself). Please share the steps if you notice a different behavior and can reproduce it.