SSH Proxy Node Does Not Show Annual Certification Status Message

When attempting to SSH into the ssh proxy login node, it does not verify whether or not the user account is in good standing (certified). However, when SSH-ing directly into cheaha.rc.uab.edu, the system appropriately reports that the account is overdue for certification and blocks access until resolved.

Attempt to SSH into cheaha.rc.uab.edu with an account requiring annual certification:

$ ssh -l USER@cheaha.rc.uab.edu  
Your annual account certification is overdue.  
Please visit https://rc.uab.edu/account to complete your certification and resume using your account.  
USER@cheaha.rc.uab.edu: Permission denied (publickey,gssapi-keyex,gssapi-with-mic).

Attempt to SSH into the ssh proxy login node:

$ ssh -l USER@138.26.49.58  
Login is successful, bypassing certification verification.

Expected Behavior: The ssh proxy login node should check the user's account certification status and deny access if the account is not in good standing, similar to cheaha.rc.uab.edu.

added Sprint 25-02 label

changed title from GPFS5 Proxy Login Node Does Not Check Annual Certification Status to SSH Proxy Node Does Not Check Annual Certification Status

changed the description

checking the user's certification status should not be performed at the SSH proxy node. The primary role of the SSH proxy is to validate the user and route their connection to the appropriate login node, either login-gpfs4 or login-gpfs5.

Instead, the certification status check should be performed on the login nodes (login-gpfs4 and login-gpfs5) via the RabbitMQ agent.

file prod_rmq_agents/ssh_access.py

added Sprint 25-03 label and removed Sprint 25-02 label

assigned to @atlurie

Need to run CRI_XCBC/roles/ood_add_groups role on the login nodes

Also need to run this on login006

The role will add 3 ssh banner/login message files:

login004 $ ls /etc/ssh/| grep msg
certification-msg
expire-msg
hold-msg

and also, add related Denied groups blocks in /etc/ssh/sshd_config, which I don't have permission to check on login004

marked this issue as related to devops#590

added Backlog label and removed Sprint 25-03 label

added Sprint 25-03 label and removed Backlog label

added Sprint 25-04 label and removed Sprint 25-03 label

marked this issue as related to devops#603

mentioned in issue devops#603

According to sshpiper author at HERE:

tg123 yesterday Owner:

this is impossible at the moment, sshpiper does not proxy upstream banner message to downstream.this is impossible at the moment, sshpiper does not proxy upstream banner message to downstream.

added Backlog label and removed Sprint 25-04 label

changed title from SSH Proxy Node Does Not Check Annual Certification Status to SSH Proxy Node Does Not Show Annual Certification Status Message

added blocked label