All users are identified as root when using ssh with a SSH loginappl
Article ID: 449917
Updated On:
Products
Issue/Introduction
In Red Hat Enterprise Linux release 9.8, when a user does login using the loginappl application defined for sshd, causes all users logged in to be identified as root.
However, following document
Sewhoami reports all users as root due to sshd-session binary change
does not help: all users using ssh are identified as root.
Environment
CA PAM SC 14.1 on Redhat 9.8 and later
Cause
As described in the document mentioned before, the latest version of Openssh, coming with Redhat 9.8 and later, has split the sshd daemon into into a listener binary (sshd) and a per-session binary (sshd-session).
In the latest versions of PAM SC 14.1 endpoint (10.14.80.59 and later) this is already corrected, but in older versions, it is necessary to create a new LOGINAPPL resource for the sshd-session binary. The path to specify varies by operating system.
It may be possible that even though having followed this instructions, and SSH loginappl showing the right applications:
Data for LOGINAPPL 'SSH'
-----------------------------------------------------------
Defaccess : X
Audit mode : Success, Failure
Owner : nobody (USER )
Create time : 24-Jul-2026 09:56
Update time : 24-Jul-2026 09:56
Updated by : root (USER )
Comment : SSH loginappl rule for LINUX
Login flags : No grace root
Login method : Normal
Login path : /usr/sbin/sshd
Login sequence : FGRP, SGRP, SGID, SUID
Data for LOGINAPPL 'SSH-SESS'
-----------------------------------------------------------
Defaccess : X
Audit mode : Failure
Owner : root (USER )
Create time : 24-Jul-2026 09:53
Update time : 24-Jul-2026 09:53
Updated by : root (USER )
Login flags : PAM login
Login method : Normal
Login path : <path_to_openssh>/sshd-session
Login sequence : SGRP, SUID
This is still not working properly.
In this case, clearing the SSH_SESS loginappl and redefining it, this may work again
Resolution
Run
rr loginappl SSH-SESS
nr loginappl SSH-SESS loginpath(<path_to_openssh>/sshd-session) defacc(all)
to properly recreate the classes
Feedback
