commit 5e011933acbcaa6b5308c69dbfb585a65a21a2f2
parent 74693bababfb95be7775fbc7cb2aa5f85a6cd836
Author: decentral1se <cellarspoon@riseup.net>
Date: Wed, 29 Jul 2026 16:39:13 +0200
docs(eik): elaborate loosely on group login checks
Diffstat:
1 file changed, 7 insertions(+), 0 deletions(-)
diff --git a/eik.mdwn b/eik.mdwn
@@ -335,3 +335,10 @@ See `/etc/rauthy/rauthy-pam-nss.toml` for the configuration. You can `journalctl
### pam
PAM users need to be created on the Rauthy admin side of things, connected to a normal user account via email. See `/etc/pam.d` for all adjusted configurations where the PAM system can ask Rauthy via API for additional login details. You can `tail -f /var/log/auth.log` to see how a log in attempt is responded to. Use the `/usr/sbin/rauthy-authorized-keys <username>` command to retrieve a SSH public key part for a specific user. The `/etc/ssh/sshd_config` is a part of the puzzle, with 2 options: 1) allowing password login with `PasswordAuthentication`. The passwords are ephemerally generated on the Rauthy user self-service UI 2) allowing `/usr/sbin/rauthy-authorized-keys` lookup with `AuthorizedKeysCommand`. We configure these options on a per-user basis.
+
+### restricting users based on group membership
+
+The forward authentication or group configuration on the software side ensures
+that users are members of a specific group before allowing them to log into a
+service. This allows us to have members of public participate in the forum but
+not the wiki.
