You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/hdinsight/domain-joined/ssh-domain-accounts.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,18 +3,18 @@ title: Manage SSH access for domain accounts in Azure HDInsight
3
3
description: Steps to manage SSH access for Azure AD accounts in HDInsight.
4
4
ms.service: hdinsight
5
5
ms.topic: how-to
6
-
ms.date: 06/30/2022
6
+
ms.date: 09/19/2023
7
7
---
8
8
9
9
# Manage SSH access for domain accounts in Azure HDInsight
10
10
11
-
On secure clusters, by default, all domain users in [Azure AD DS](../../active-directory-domain-services/overview.md) are allowed to [SSH](../hdinsight-hadoop-linux-use-ssh-unix.md) into the head and edge nodes. These users are not part of the sudoers group and do not get root access. The SSH user created during cluster creation will have root access.
11
+
On secure clusters, by default, all domain users in [Azure AD DS](../../active-directory-domain-services/overview.md) are allowed to [SSH](../hdinsight-hadoop-linux-use-ssh-unix.md) into the head and edge nodes. These users are not part of the sudoers group and do not get root access. The SSH user created during cluster creation has root access.
12
12
13
13
## Manage access
14
14
15
15
To modify SSH access to specific users or groups, update `/etc/ssh/sshd_config` on each of the nodes.
16
16
17
-
1. Use [ssh command](../hdinsight-hadoop-linux-use-ssh-unix.md) to connect to your cluster. Edit the command below by replacing CLUSTERNAME with the name of your cluster, and then enter the command:
17
+
1. Use [ssh command](../hdinsight-hadoop-linux-use-ssh-unix.md) to connect to your cluster. Edit the following command by replacing CLUSTERNAME with the name of your cluster, and then enter the command:
@@ -26,7 +26,7 @@ To modify SSH access to specific users or groups, update `/etc/ssh/sshd_config`
26
26
sudo nano /etc/ssh/sshd_config
27
27
```
28
28
29
-
1. Modify the `sshd_config` file as desired. If you restrict users to certain groups, then the local accounts cannot SSH into that node. The following is only an example of syntax:
29
+
1. Modify the `sshd_config` file as desired. If you restrict users to certain groups, then the local accounts cannot SSH into that node. The following command is only an example of syntax:
30
30
31
31
```bash
32
32
AllowUsers useralias1 useralias2
@@ -46,11 +46,11 @@ To modify SSH access to specific users or groups, update `/etc/ssh/sshd_config`
46
46
47
47
## SSH authentication log
48
48
49
-
SSH authentication log is written into `/var/log/auth.log`. If you see any login failures through SSH for local or domain accounts, you will need to go through the log to debug the errors. Often the issue might be related to specific user accounts and it's usually a good practice to try other user accounts or SSH using the default SSH user (local account) and then attempt a kinit.
49
+
SSH authentication log is written into `/var/log/auth.log`. If you see any login failures through SSH for local or domain accounts, you need to go through the log to debug the errors. Often the issue might be related to specific user accounts and it's usually a good practice to try other user accounts or SSH using the default SSH user (local account) and then attempt a kinit.
50
50
51
51
## SSH debug log
52
52
53
-
To enable verbose logging, you will need to restart `sshd` with the `-d` option. Like `/usr/sbin/sshd -d` You can also run `sshd` at a custom port (like 2222) so that you don't have to stop the main SSH daemon. You can also use `-v` option with the SSH client to get more logs (client side view of the failures).
53
+
To enable verbose logging, you need to restart `sshd` with the `-d` option. Like `/usr/sbin/sshd -d` You can also run `sshd` at a custom port (like 2222) so that you don't have to stop the main SSH daemon. You can also use `-v` option with the SSH client to get more logs (client side view of the failures).
0 commit comments