headers
bloguillard | 13 Mar 2012 17:13
Picon

check group membership locally and in also in ldap

Hello,

I have configure a redhat box to authenticate users over an
openldap server. "Systems" account ( uid > 500 ) are not
created in ldap but are authentified over local password db.

system-auth :
...
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        required      pam_deny.so
...

My ldap directory also contains posixgroups.

I noticed that if I configure locally a system account to use
an ldap GID, then the user is properly registered as a member
of this group as well as any other groups it would be member
of locally ( declared in /etc/group ).

But if I declare in local /etc/passwd a local group as being the
primary group for that user, then the user is not registered as being
member of any ldap group it would be "subscribed" to.

QUESTION : is there anyway to configure pam to say that the
user group list includes ldap groups the user is member of
as well as local groups, even if the primary group of that user
is local ?
(Continue reading)

Permalink | Reply | 2 comments |
headers
Stef Bon | 13 Mar 2012 17:37
Picon

Re: check group membership locally and in also in ldap

Isn't this a nss question, and not PAM?

Stef

2012/3/13 bloguillard <blog <at> guillard.nom.fr>:
> Hello,
>
> I have configure a redhat box to authenticate users over an
> openldap server. "Systems" account ( uid > 500 ) are not
> created in ldap but are authentified over local password db.
>
> system-auth :
> ...
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so nullok try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        sufficient    pam_sss.so use_first_pass
> auth        required      pam_deny.so
> ...
>
> My ldap directory also contains posixgroups.
>
> I noticed that if I configure locally a system account to use
> an ldap GID, then the user is properly registered as a member
> of this group as well as any other groups it would be member
> of locally ( declared in /etc/group ).
>
> But if I declare in local /etc/passwd a local group as being the
> primary group for that user, then the user is not registered as being
> member of any ldap group it would be "subscribed" to.
(Continue reading)

Permalink | Reply | 1 comment |
headers
bloguillard | 13 Mar 2012 17:38
Picon

Re: check group membership locally and in also in ldap

Note :

To clarify what I try to do :

I try to create an ldap "sysgroup" posixgroup entry whose usual
(and unusual) "sysaccounts" would be member of to be able
grant to the members of that "sysgroup" specific rights ( declared
in security/access.conf).

I'm also open to suggestions :-)

--
Olivier

2012/3/13 bloguillard <blog <at> guillard.nom.fr>:
> Hello,
>
> I have configure a redhat box to authenticate users over an
> openldap server. "Systems" account ( uid > 500 ) are not
> created in ldap but are authentified over local password db.
>
> system-auth :
> ...
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so nullok try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        sufficient    pam_sss.so use_first_pass
> auth        required      pam_deny.so
> ...
>
(Continue reading)

Permalink | Reply | 0 comments |
headers
bloguillard | 13 Mar 2012 20:49
Picon

Re: check group membership locally and in also in ldap

Ooops : you are right.

I have written in nsswitch.conf :

group:    sss files

instead of

group:    files sss

And I obtain ( more or less) what I want.

Thanks !

---
Olivier

2012/3/13 Stef Bon :
> Isn't this a nss question, and not PAM?
>
> Stef
>
> 2012/3/13 bloguillard <blog <at> guillard.nom.fr>:
>> Hello,
>>
>> I have configure a redhat box to authenticate users over an
>> openldap server. "Systems" account ( uid > 500 ) are not
>> created in ldap but are authentified over local password db.
>>
>> system-auth :
(Continue reading)

Permalink | Reply | 0 comments |
headers
josh | 25 Mar 2012 17:10
Picon

pammount not unmounting encrypted home on logout

Hi,

I have individually LUKS encrypted home dirs on my system which are
mounted at login via pammount. I have one, maybe two problems that I am
unable to track down, and which may be related.

First of all, the encrypted dirs seem to be getting mounted twice when
the user logs in. Here are the relevant lines in df output after login:

/dev/mapper/_dev_sdb1 57690744 20835188 36269436 37% /home/josh
/dev/sdb1 57690744 20835188 36269436 37% /home/josh

Secondly, and most importantly, the encrypted home partitions are not
being completely unmounted on logout. After logout, only one of the
above has been unmounted, df reports:

/dev/mapper/_dev_sdb1 57690744 20835284 36269340 37% /home/josh

This also happens even if lsof doesn't report any open files for the
user (a common cause of having the partion not unmounted, if memory
serves...)

The relevant line in /etc/security/pam_mount.conf.xml is:

<volume user="josh" mountpoint="/home/josh"
path="/dev/disk/by-uuid/967e7b41-b9cc-48f0-94e8-c2c3eb2a4dd0"
fstype="crypt" />

and this is the only reference to mounting this volume, i.e. no other
mounting lines somewhere in fstab or crypttab. I use disk-by-uuid
(Continue reading)

Permalink | Reply | 2 comments |
headers
Yann Ormanns | 26 Mar 2012 08:39

"PAM unable to resolve symbol"

Good morning,
one of my systems sporadically log the following error messages:

----------------------------------------------------------------
PAM unable to resolve symbol: pam_sm_open_session
PAM unable to resolve symbol: pam_sm_close_session
----------------------------------------------------------------

The problem is not reproducable yet, since I do not know what could be 
going wrong.
The whole context in /var/log/auth looks like following:
----------------------------------------------------------------
Mar 25 06:45:21 Atlas sudo:   zabbix : TTY=unknown ; PWD=/ ; USER=root ; 
COMMAND=/usr/sbin/smartctl -a /dev/sdf
Mar 25 06:45:21 Atlas sudo: pam_unix(sudo:session): session opened for 
user root by (uid=103)
Mar 25 06:45:21 Atlas sudo: pam_unix(sudo:session): session closed for 
user root
Mar 25 06:45:26 Atlas auth: PAM unable to resolve symbol: 
pam_sm_open_session
Mar 25 06:45:26 Atlas auth: PAM unable to resolve symbol: 
pam_sm_close_session
Mar 25 06:45:26 Atlas auth: PAM unable to resolve symbol: 
pam_sm_open_session
Mar 25 06:45:26 Atlas auth: PAM unable to resolve symbol: 
pam_sm_close_session
Mar 25 06:45:26 Atlas auth: PAM unable to resolve symbol: 
pam_sm_open_session
Mar 25 06:45:26 Atlas auth: PAM unable to resolve symbol: 
pam_sm_close_session
(Continue reading)

Permalink | Reply | 0 comments |
headers
Stef Bon | 26 Mar 2012 10:41
Picon

Re: pammount not unmounting encrypted home on logout

HI,

well probably some app is still using the mount directory.

I've been working on constructions (and still do) which mount a
"Media" directory when a user logs in, and other constructions, like
the chroot and (re)mounting to turn the system into a GoboLinux like
system.

What I ran into is that still after logging out of KDE there are still
apps using the home directory. I had to make a construction which
kills these first, and then umounts.
Isn't it possible to do a lazy umount with pammount ??

I would never use the mounting directly. Better is a construction
which uses pamexec or pamscript which run scripts at auth, login and
logout. and create a construction  to run scripts in order, where you
have the ability to specify that the login process has to wait for
completion (something like systemd but then for usersessions)

Stef

2012/3/25 josh <jbuhl_nospam <at> gmx.net>:
> Hi,
>
> I have individually LUKS encrypted home dirs on my system which are
> mounted at login via pammount. I have one, maybe two problems that I am
> unable to track down, and which may be related.
>
> First of all, the encrypted dirs seem to be getting mounted twice when
(Continue reading)

Permalink | Reply | 0 comments |
headers
Pablo Schuhwerk | 30 Mar 2012 23:56
Picon

pam_mount to avoid passwd uid

Hi guys,


Could anyone help understand how could I get pam_mount not messing with my local users form /etc/passwd?

I'm using it for LDAP users get their homes automounted from NFS.
But it is overwriting my local homes for users from passwd file, when they login, it creates a new /home/$uid directory, overwriting
the original mounted from fstab.

Any help will be really appreciated.

Regards,

Ivan.
_______________________________________________
Pam-list mailing list
Pam-list <at> redhat.com
https://www.redhat.com/mailman/listinfo/pam-list
Permalink | Reply | 1 comment |
headers
Stef Bon | 31 Mar 2012 12:11
Picon

Re: pam_mount to avoid passwd uid

Well why do you use pam_mount for automounting the homes directories?
Using the automounter only is enough. But then you have to use
something like:

/home/... for local users
/home.remote/... for remote users

or something simular.

And then setup the automounter to mount the users home directory
when accessing /home.remote/X. I'm not familiar with nfs, but the
automounter offers various abilities to mount from nfs. This setup is
access based, and not PAM.

Stef

2012/3/30 Pablo Schuhwerk <zen.suite <at> gmail.com>:
> Hi guys,
>
> Could anyone help understand how could I get pam_mount not messing with my
> local users form /etc/passwd?
>
> I'm using it for LDAP users get their homes automounted from NFS.
> But it is overwriting my local homes for users from passwd file, when they
> login, it creates a new /home/$uid directory, overwriting
> the original mounted from fstab.
>
> Any help will be really appreciated.
>
> Regards,
>
> Ivan.
>
> _______________________________________________
> Pam-list mailing list
> Pam-list <at> redhat.com
> https://www.redhat.com/mailman/listinfo/pam-list

_______________________________________________
Pam-list mailing list
Pam-list <at> redhat.com
https://www.redhat.com/mailman/listinfo/pam-list
Permalink | Reply | 0 comments |

Gmane