Russ Allbery <[email protected]> writes:
> Oh, I understand now. pam_unix fails, and you were expecting pam_krb5
> to return success (blindly) to counter pam_unix's failure, but since
> pam_krb5 (correctly) returns PAM_IGNORE for users about which it has no
> information, logins are failing because of the pam_unix failure. Or, if
> you remove pam_unix, because all modules in the stack returned
> PAM_IGNORE.
Oh, and the other piece I forgot to mention: you saw this start happening
in lenny because in etch pam-krb5 did blindly return PAM_SUCCESS if the
user didn't log in with a password. This was changed in 3.11:
pam_setcred, pam_open_session, and pam_acct_mgmt now return PAM_IGNORE
for ignored users or non-Kerberos logins rather than PAM_SUCCESS.
This return code tells the PAM library to continue as if the module
were not present in the configuration and allows sufficient to be
meaningful for pam-krb5 in account and session groups.
--
Russ Allbery ([email protected]) <http://www.eyrie.org/~eagle/>
_______________________________________________
OpenAFS-info mailing list
[email protected]
https://lists.openafs.org/mailman/listinfo/openafs-info
