Hello, in pam_access.c function pam_sm_setcred always returning PAM_IGNORE, but in "man pam_sm_setcred" PAM_IGNORE is not in the list of possible return values. This behavior gives us some unpredictable results while we using this pam module. Should it be better to always return PAM_SUCCESS like in pam_rhosts.c? Best, Alexander Bersenev
On Thu, May 05, Александр Берсенев wrote: > Hello, > in pam_access.c function pam_sm_setcred always returning PAM_IGNORE, > but in "man pam_sm_setcred" PAM_IGNORE is not in the list of possible > return values. > > This behavior gives us some unpredictable results while we using this > pam module. Should it be better to always return PAM_SUCCESS like in > pam_rhosts.c? > Why does this give you some unpredictable results? Are you calling PAM modules directly from your application? In general, a PAM module can more or less always return what it likes. The manual page is only a good catch of the most common return values, not that no other are allowed. Thorsten -- -- Thorsten Kukuk, Project Manager/Release Manager SLES SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) _______________________________________________ Pam-list mailing list Pam-list <at> redhat.com https://www.redhat.com/mailman/listinfo/pam-list
About unpredictable results. Here is a my /etc/pam.d/rsh config, for simpleness /etc/security/access.conf is empty(allow everyone) and /etc/security/pam_env.conf is also empty(not set any env): #%PAM-1.0 auth sufficient pam_access.so auth optional pam_env.so account include password-auth session optional pam_keyinit.so force revoke session required pam_loginuid.so session include password-auth The rsh authorizes me successfully: [u1333 <at> um32 ~]$ rsh umu4 id uid=1003(u1333) gid=100(users) группы=100(users),1013(OSO),5001(um32),5005(um64),5006(umt),5007(cluster_sudo) But this configuration gives me an access denied error: #%PAM-1.0 auth sufficient pam_access.so #auth optional pam_env.so account include password-auth session optional pam_keyinit.so force revoke session required pam_loginuid.so(Continue reading)
On 06.05.2011 13:00, Александр Берсенев wrote: > About unpredictable results. > Here is a my /etc/pam.d/rsh config, for simpleness > /etc/security/access.conf is empty(allow everyone) and > /etc/security/pam_env.conf is also empty(not set any env): > > #%PAM-1.0 > > auth sufficient pam_access.so > auth optional pam_env.so > > account include password-auth > session optional pam_keyinit.so force revoke > session required pam_loginuid.so > session include password-auth > > The rsh authorizes me successfully: > [u1333 <at> um32 ~]$ rsh umu4 id > uid=1003(u1333) gid=100(users) > группы=100(users),1013(OSO),5001(um32),5005(um64),5006(umt),5007(cluster_sudo) > > But this configuration gives me an access denied error: > > #%PAM-1.0 > > auth sufficient pam_access.so > #auth optional pam_env.so > > account include password-auth > session optional pam_keyinit.so force revoke(Continue reading)
Yes, you are right, adding pam_permit.so helps. There are some inconsistency in pam: almost half of pam_sm_setcred functions in auth modules are returning PAM_SUCCESS unconditionally, other fews are returning PAM_IGNORE: PAM_IGNORE: pam_access, pam_echo, pam_exec, pam_faildelay, pam_ftp, pam_issue, pam_sepermit, pam_succeed_if, pam_warn PAM_SUCCESS: pam_listfile, pam_localuser, pam_permit, pam_rhosts, pam_rootok, pam_securetty, pam_selinux, pam_shells, pam_timestamp, pam_userdb, pam_wheel In man page says that pam_sm_setcred function performs the task of altering the credentials of the user with respect to the corresponding authorization scheme. So, If all modules not alter the credentials(return PAM_IGNORE) user access will be denied. If I understand correctly, a writer of /etc/pam.d/... configs must use at least one module from second list in auth stack. This is nontrivial thing. And it seems this is impossible to patch - changes are too big. But pam_permit in the end is working, thank you. Best, Alexander Bersenev
On Fri, 2011-05-06 at 19:32 +0000, Александр Берсенев wrote: > Yes, you are right, adding pam_permit.so helps. > > There are some inconsistency in pam: almost half of pam_sm_setcred > functions in auth modules are returning PAM_SUCCESS unconditionally, > other fews are returning PAM_IGNORE: > PAM_IGNORE: pam_access, pam_echo, pam_exec, pam_faildelay, pam_ftp, > pam_issue, pam_sepermit, pam_succeed_if, pam_warn > PAM_SUCCESS: pam_listfile, pam_localuser, pam_permit, pam_rhosts, > pam_rootok, pam_securetty, pam_selinux, pam_shells, pam_timestamp, > pam_userdb, pam_wheel > > In man page says that pam_sm_setcred function performs the task of > altering the credentials of the user with respect to the corresponding > authorization scheme. So, If all modules not alter the > credentials(return PAM_IGNORE) user access will be denied. > > If I understand correctly, a writer of /etc/pam.d/... configs must use > at least one module from second list in auth stack. This is nontrivial > thing. And it seems this is impossible to patch - changes are too big. > > But pam_permit in the end is working, thank you. I think that in the next major release of Linux-PAM we should unify these return codes in pam_sm_setcred so that the admin can depend on them. -- -- Tomas Mraz No matter how far down the wrong road you've gone, turn back. Turkish proverb(Continue reading)
Hi
How do I restack these pam rules so auth type of ldap service
will still be a PAM_SUCCESS and seamless to the user even
when ldap server is unavailable?
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so
I noticed pam_ldap module has the following argument
ignore_authinfo_unavail
Specifies that pam_ldap should return PAM_IGNORE if it
cannot contact the LDAP server. This option forces
the PAM framework to ignore the pam_ldap module in this case.
I am thinking of stacking it like this. So if ldap server unavailable,
pam_ldap will
be ignored and it will let the users' in if listed in local passwd
file. However, I
need to make sure when ldap server available, if the pam_ldap fails this stack
will fail and not allow user with invalide ldap passwd.
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_ldap.so use_first_pass ignore_authinfo_unavail
(Continue reading)
RSS Feed11 | |
|---|---|
3 | |
2 | |
11 | |
6 | |
6 | |
121 | |
7 | |
7 | |
1 | |
1 | |
2 | |
9 | |
8 | |
15 | |
15 | |
21 | |
7 | |
7 | |
21 | |
14 | |
7 | |
1 | |
6 | |
4 | |
10 | |
21 | |
3 | |
7 | |
1 | |
9 | |
18 | |
11 | |
1 | |
7 | |
14 | |
7 | |
14 | |
3 | |
32 | |
7 | |
36 | |
33 | |
14 | |
5 | |
23 | |
30 | |
23 | |
14 | |
6 | |
21 | |
44 | |
23 | |
4 | |
33 | |
48 | |
24 | |
43 | |
27 | |
18 | |
21 | |
35 | |
38 | |
35 | |
66 | |
39 | |
37 | |
24 | |
15 | |
44 | |
62 | |
20 | |
24 | |
21 | |
19 | |
19 | |
27 | |
14 | |
30 | |
14 | |
32 | |
29 | |
20 | |
30 | |
59 | |
24 | |
29 | |
79 | |
35 | |
12 | |
24 | |
27 | |
24 | |
29 | |
29 | |
44 | |
82 | |
25 | |
64 | |
53 | |
74 | |
45 | |
31 | |
83 | |
66 | |
28 | |
41 | |
70 | |
22 | |
54 | |
29 | |
47 | |
89 | |
44 | |
56 | |
34 | |
85 | |
93 | |
65 | |
84 | |
56 | |
77 | |
51 | |
30 | |
59 | |
76 | |
71 | |
80 | |
112 | |
80 | |
31 | |
1 |
