Pluggable Authentication Modules

Stewart Adam | 5 Mar 2006 07:29

pam_tally & SSH not working properly at all -- FC5T3 w/ pam 0.99

Hello,
I'm completely confused, maybe it's a bug.
http://www.fedoraforum.org/forum/showthread.php?t=97416
I've started a thread there on FedoraForum with more info, but basically 
this is my situation:
- /etc/pam.d/sshd file:
-- start --
#%PAM-1.0
auth       include      system-auth
auth       required     pam_tally.so onerr=fail deny=3
account    required     pam_nologin.so
account    include      system-auth
account    required     pam_tally.so
password   include      system-auth
session    include      system-auth
session    required     pam_loginuid.so
-- end --
- I do have pam enabled in my sshd_config file.
- I only want pam_tally for my ssh server, so that's why it's only in sshd 
and non system authentication.

Here's the problem:
--> I reset my counter just incase
--> I do 5 bad SSH logins, even though my counter is 3 just to make sure
--> I run "pam_tally --user admin" and it shows my 5 bad attempts
--> My system logs show pam_tally is recording my bad attempts
--> If I type the right password it still lets my login
In FC5T3 there's an additional "pam_tally2" module. Should I be using this 
one? I tried using that one with the same options and it still has no effect 
but the same results.

(Continue reading)

headers

Darren Tucker | 5 Mar 2006 07:51

Re: pam_tally & SSH not working properly at all -- FC5T3 w/ pam 0.99

Stewart Adam wrote:
> Hello,
> I'm completely confused, maybe it's a bug.
> http://www.fedoraforum.org/forum/showthread.php?t=97416
> I've started a thread there on FedoraForum with more info, but basically
> this is my situation:
> - /etc/pam.d/sshd file:
> -- start --
> #%PAM-1.0
> auth       include      system-auth
> auth       required     pam_tally.so onerr=fail deny=3

Does /etc/pam.d/system-auth have any "sufficient" modules?  If so, the
authentication succeeds at that point and never gets as far as pam_tally
when your password is right.

Also, if you're used to pam_stack, be aware that in and the "include"
directive have subtly different semantics.

--

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

headers

Stewart Adam | 5 Mar 2006 17:30

Re: pam_tally & SSH not working properly at all -- FC5T3 w/ pam 0.99

/etc/pam.d/systam-auth file:
-- start --
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so retry=3
password    sufficient    pam_unix.so md5 nullok try_first_pass use_authtok
password    required      pam_deny.so

session     required      pam_limits.so
session     required      pam_unix.so
-- end --
Do I have to change them to "Required"? Or would I be able to make it so 
that I tell my system to use pam_tally for everything, but it will only 
block SSH?
Thanks,
Firewing1

>From: Darren Tucker <dtucker <at> zip.com.au>
>Reply-To: Pluggable Authentication Modules <pam-list <at> redhat.com>
>To: Pluggable Authentication Modules <pam-list <at> redhat.com>

(Continue reading)

headers

Darren Tucker | 6 Mar 2006 05:07

Re: pam_tally & SSH not working properly at all -- FC5T3 w/ pam 0.99

On Sun, Mar 05, 2006 at 11:30:57AM -0500, Stewart Adam wrote:
> /etc/pam.d/systam-auth file:
> -- start --
> #%PAM-1.0
> # This file is auto-generated.
> # User changes will be destroyed the next time authconfig is run.
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so nullok try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        required      pam_deny.so

[...]
> Do I have to change them to "Required"?

Just blindly changing "sufficient" to "required" won't do what you
want since the "required pam_deny.so" will mean that you will end up
disallowing all authentications.

> Or would I be able to make it so that I tell my system to use pam_tally
> for everything, but it will only block SSH?

The safest thing to do is probably constructing a sshd PAM config
file that does what you want starting with a copy of system-auth.
Something like this for the auth section ought to work (untested):

auth        required      pam_env.so
auth        required      pam_unix.so nullok try_first_pass
auth        required      pam_tally.so
auth        requisite     pam_succeed_if.so uid >= 500 quiet

(Continue reading)

headers

Tomas Mraz | 6 Mar 2006 10:19

Re: pam_tally & SSH not working properly at all -- FC5T3 w/ pam 0.99

On Sun, 2006-03-05 at 01:29 -0500, Stewart Adam wrote:
> Hello,
> I'm completely confused, maybe it's a bug.
> http://www.fedoraforum.org/forum/showthread.php?t=97416
> I've started a thread there on FedoraForum with more info, but basically 
> this is my situation:
> - /etc/pam.d/sshd file:
> -- start --
> #%PAM-1.0
> auth       include      system-auth
> auth       required     pam_tally.so onerr=fail deny=3
Move pam_tally.so before the include.

> account    required     pam_nologin.so
> account    include      system-auth
> account    required     pam_tally.so
The same thing here.

> password   include      system-auth
> session    include      system-auth
> session    required     pam_loginuid.so
> -- end --
> - I do have pam enabled in my sshd_config file.
> - I only want pam_tally for my ssh server, so that's why it's only in sshd 
> and non system authentication.
> 
> Here's the problem:
> --> I reset my counter just incase
> --> I do 5 bad SSH logins, even though my counter is 3 just to make sure
> --> I run "pam_tally --user admin" and it shows my 5 bad attempts

(Continue reading)

headers

Stewart Adam | 6 Mar 2006 22:44

Re: pam_tally & SSH not working properly at all -- FC5T3 w/ pam 0.99

Alright... I think we've made progress but still nothing.
-- start /etc/pam.d/sshd --
#%PAM-1.0
auth       include      system-auth
auth       required     pam_tally.so onerr=fail deny=3
auth        required      pam_env.so
auth        required      pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
account    required     pam_nologin.so
account    include      system-auth
account    required     pam_tally.so
password   include      system-auth
session    include      system-auth
session    required     pam_loginuid.so
-- end sshd --

-- start /etc/pam.d/system-auth --
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

account     required      pam_unix.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     required      pam_permit.so

password    requisite     pam_cracklib.so retry=3

(Continue reading)

headers

John Ferrell | 6 Mar 2006 19:20

PAM_LDAP verbose logging?

I am trying to configure my Red Hat AS 4.2 box to authenticate users
using LDAP. More specifically, I only want to verify the user's
password using LDAP, the accounts are local. As far as I can tell then
system is performing the LDAP bind during the login process; using
tcpflow I can see the LDAP information passed to the server.
Unfortunately, I cannot tell what is really going on. Even though I
have 'debug' option enabled in the pam config file, the logs do not
show any pam_ldap activity.

Below is a snippet from the sshd pam config with LDAP:
#LDAP
auth sufficient pam_ldap.so use_first_pass debug
auth required pam_stack.so service=system-auth
auth required pam_nologin.so
account required pam_stack.so service=system-auth
...

Originally, I was getting a LDAP bind error in /var/log/messages.
After fixing ldap.conf and verifying the settings using ldapsearch, I no
longer see the error. However, I don't see an specific pam_ldap errors
in any of my logs now.

I have done some searching and found a few news group posts with
some sample logs. It looks like there is a way to enable more verbose
logging:

Dec 8 10:04:43 linux29 login[2063]: pam_ldap: error trying to bind as
user "cn=Linux29,ou=SER,ou=KLK,o=EK" (Invalid credentials)

There is a debug option in ldap.conf, but that just created a log file
with output similar to running ldapsearch with the debugging option.

Hopefully someone can point me to the debugging option so that my logs
are a bit more helpful in troubleshooting this issue.

thanks,
John

_______________________________________________
Pam-list mailing list
Pam-list <at> redhat.com
https://www.redhat.com/mailman/listinfo/pam-list

headers

Stewart Adam | 9 Mar 2006 00:30

Re: pam_tally & SSH not working properly at all -- FC5T3 w/ pam 0.99

/etc/pam.d/system-auth:
#%PAM-1.0
...
auth        sufficient    pam_unix.so nullok try_first_pass
...
account     sufficient    pam_succeed_if.so uid < 500 quiet
...
password    sufficient    pam_unix.so md5 nullok try_first_pass use_authtok
...
These lines are really annoyimg me know. How can I change them so that 
they're no longer "sufficient" but just part of the process? (As in so that 
the auth doesn't stop there and so that pam_tally has an effect)
Firewing1
-----------------------------------------------------------------------------------------
My web site:
http://www.nongnu.org/script-wing

>From: Darren Tucker <dtucker <at> zip.com.au>
>Reply-To: dtucker <at> zip.com.au,Pluggable Authentication Modules 
><pam-list <at> redhat.com>
>To: Pluggable Authentication Modules <pam-list <at> redhat.com>
>Subject: Re: pam_tally & SSH not working properly at all -- FC5T3 w/ pam 
>0.99
>Date: Mon, 6 Mar 2006 15:07:00 +1100
>
>On Sun, Mar 05, 2006 at 11:30:57AM -0500, Stewart Adam wrote:
> > /etc/pam.d/systam-auth file:
> > -- start --
> > #%PAM-1.0
> > # This file is auto-generated.
> > # User changes will be destroyed the next time authconfig is run.
> > auth        required      pam_env.so
> > auth        sufficient    pam_unix.so nullok try_first_pass
> > auth        requisite     pam_succeed_if.so uid >= 500 quiet
> > auth        required      pam_deny.so
>
>[...]
> > Do I have to change them to "Required"?
>
>Just blindly changing "sufficient" to "required" won't do what you
>want since the "required pam_deny.so" will mean that you will end up
>disallowing all authentications.
>
> > Or would I be able to make it so that I tell my system to use pam_tally
> > for everything, but it will only block SSH?
>
>The safest thing to do is probably constructing a sshd PAM config
>file that does what you want starting with a copy of system-auth.
>Something like this for the auth section ought to work (untested):
>
>auth        required      pam_env.so
>auth        required      pam_unix.so nullok try_first_pass
>auth        required      pam_tally.so
>auth        requisite     pam_succeed_if.so uid >= 500 quiet
>
>--
>Darren Tucker (dtucker at zip.com.au)
>GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
>     Good judgement comes with experience. Unfortunately, the experience
>usually comes from bad judgement.
>
>_______________________________________________
>Pam-list mailing list
>Pam-list <at> redhat.com
>https://www.redhat.com/mailman/listinfo/pam-list

headers

Thorsten Kukuk | 11 Mar 2006 22:22

return value of pam_getenvlist mismatch to XSSO


Hi,

The X/Open Single Sign-on Service (XSSO) documentation says about the
return value of pam_getenvlist():

"If no values are set, a NULL pointer is returned."

Linux-PAM does not return a NULL pointer, but a pointer to a NULL
pointer.
OpenPAM, which claims to be conform to this standard also returns
a pointer to a NULL pointer if not values are set.

After reading the manual pages of other OS I think XSSO should be
adjusted, not our pam_getenvlist() implementation.

Does somebody know more about this? Other opinions?

  Thorsten
--

-- 
Thorsten Kukuk         http://www.suse.de/~kukuk/      kukuk <at> suse.de
SUSE LINUX Products GmbH       Maxfeldstr. 5       D-90409 Nuernberg
--------------------------------------------------------------------    
Key fingerprint = A368 676B 5E1B 3E46 CFCE  2D97 F8FD 4E23 56C6 FB4B

headers

Jon Nettleton | 21 Mar 2006 01:02

getting ready to take over pam_keyring

Hello,

This is my first post to the pam list.  I am getting ready to take over
the development of the pam_keyring module from Mike Petullo.  I have
read a lot of the feedback that he got when he first introduced the
module and tried to incorporate a lot of it into this release.  Since
this is my first shot at writing a pam module I would love if you could
take the time to check my code and comment on any glaring mistakes.  I
still have to update the Changelog and requirements sections, but here
is a quick rundown.

Changelog

  * I have updated pam_keyring.so to better match the coding standards
of pam 0.99
      * gnome-keyring-utility is renamed to pam-keyring-utility and
        added to the build process
      * pam-keyring-utility has been updated to better match
        gnome-keyring coding styles
      * pam-keyring-utility now uses the g_option command line parser

Requirements

        gnome-keyring >= 0.4.8
        gnome-session >= 2.10
        pam >= 0.99

You can download the source tarball from here

http://www.hekanetworks.com/opensource/pam_keyring/pam_keyring-0.0.6.tar.gz

Thanks for taking the time.

Jon

Mon	Tue	Wed	Thu	Fri	Sat	Sun

		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31

1	May 2013
2	April 2013
11	March 2013
6	January 2013
6	December 2012
121	November 2012
7	September 2012
7	August 2012
1	July 2012
1	June 2012
2	April 2012
9	March 2012
8	January 2012
15	December 2011
15	November 2011
21	October 2011
7	September 2011
7	August 2011
21	July 2011
14	June 2011
7	May 2011
1	April 2011
6	March 2011
4	February 2011
10	January 2011
21	December 2010
3	November 2010
7	October 2010
1	August 2010
9	July 2010
18	June 2010
11	May 2010
1	April 2010
7	March 2010
14	February 2010
7	January 2010
14	December 2009
3	November 2009
32	October 2009
7	September 2009
36	August 2009
33	July 2009
14	June 2009
5	May 2009
23	April 2009
30	March 2009
23	February 2009
14	January 2009
6	December 2008
21	November 2008
44	October 2008
23	September 2008
4	August 2008
33	July 2008
48	June 2008
24	May 2008
43	April 2008
27	March 2008
18	February 2008
21	January 2008
35	December 2007
38	November 2007
35	October 2007
66	September 2007
39	August 2007
37	July 2007
24	June 2007
15	May 2007
44	April 2007
62	March 2007
20	February 2007
24	January 2007
21	December 2006
19	November 2006
19	October 2006
27	September 2006
14	August 2006
30	July 2006
14	June 2006
32	May 2006
29	April 2006
20	March 2006
30	February 2006
59	January 2006
24	December 2005
29	November 2005
79	October 2005
35	September 2005
12	August 2005
24	July 2005
27	June 2005
24	May 2005
29	April 2005
29	March 2005
44	February 2005
82	January 2005
25	December 2004
64	November 2004
53	October 2004
74	September 2004
45	August 2004
31	July 2004
83	June 2004
66	May 2004
28	April 2004
41	March 2004
70	February 2004
22	January 2004
54	December 2003
29	November 2003
47	October 2003
89	September 2003
44	August 2003
56	July 2003
34	June 2003
85	May 2003
93	April 2003
65	March 2003
84	February 2003
56	January 2003
77	December 2002
51	November 2002
30	October 2002
59	September 2002
76	August 2002
71	July 2002
80	June 2002
112	May 2002
80	April 2002
31	March 2002
1	February 2002