On Thu, 04 Nov 2010 18:19:46 +0100 Pierfrancesco Caci <[email protected]> wrote:
> > That said, su using radius comes a bit of a surprise. Is this a known > issue, is there some workaround ? more info (thanks ras!): [9.2R4.4] and [9.5R3.7] % cat /etc/pam.conf su auth sufficient pam_rootok.so no_warn su auth sufficient pam_self.so no_warn su auth requisite pam_group.so no_warn group=wheel fail_safe root_only su auth required pam_unix.so try_first_pass login auth sufficient pam_radius.so conf=/var/etc/pam_radius.conf template_user=remote try_first_pass no_warn login account sufficient pam_radius.so conf=/var/etc/pam_radius.conf template_user=remote login password required pam_radius.so conf=/var/etc/pam_radius.conf template_user=remote login auth required pam_unix.so local_fallback no_warn login session required pam_permit.so login account required pam_unix.so [9.6R1.13] % cat /etc/pam.conf su auth sufficient pam_rootok.so no_warn su auth sufficient pam_self.so no_warn su auth include login su auth required pam_unix.so try_first_pass login auth sufficient pam_radius.so conf=/var/etc/pam_radius.conf template_user=remote try_first_pass no_warn login account sufficient pam_radius.so conf=/var/etc/pam_radius.conf template_user=remote login password required pam_radius.so conf=/var/etc/pam_radius.conf template_user=remote login auth required pam_unix.so local_fallback no_warn login session required pam_permit.so login account required pam_unix.so --- pam9.2 2010-11-05 08:14:01.000000000 +0100 +++ pam9.6 2010-11-05 08:13:48.000000000 +0100 @@ -1,7 +1,7 @@ % cat /etc/pam.conf su auth sufficient pam_rootok.so no_warn su auth sufficient pam_self.so no_warn -su auth requisite pam_group.so no_warn group=wheel fail_safe root_only +su auth include login su auth required pam_unix.so try_first_pass login auth sufficient pam_radius.so conf=/var/etc/pam_radius.conf template_user=remote try_first_pass no_warn login account sufficient pam_radius.so conf=/var/etc/pam_radius.conf template_user=remote so somewhere between 9.5 and 9.6 they changed the pam configuration for su. Changing authorization-order to [radius password] makes me able to su again, but exposes my last resort user when radius is reachable, which I don't want. -- Pierfrancesco Caci <[email protected]> _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
