On Mon, Jan 5, 2009 at 1:56 PM, Philip Lowman <[email protected]> wrote:
>> Is there any update for this? From my point of view pam-auth-update >> seems to be a step backwards from auth-client-config so long as there is >> no built-in support for configuring kerberos. I guess it's back to >> configuring /etc/pam.d manually? >> >I'm not sure if this solves your problem, but if you're trying to configure >a Linux system to use Kerberos for authentication you can use >auth-client-config: > > *sudo auth-client-config -a -p kerberos_example* Adam, Yeah, I tried this starting from the stock PAM configuration that comes with Ubuntu 8.10 and for some reason it didn't work on our systems (although I've done this before on Ubuntu 8.04 with success). I didn't mean to blame pam-auth-update for the problem, I wasn't sure what the issue was exactly a couple of days ago, I was just frustrated that things didn't "just work". I looked a little closer at the issue today and I believe the problem has something to do with pam_unix.so and pam_krb5.so lines in common- auth being swapped. Here they are in my Ubuntu 8.04 common-auth Ubuntu 8.04 common-auth: ============ auth [success=done default=ignore] pam_unix.so nullok_secure debug auth [authinfo_unavail=ignore success=1 default=2] pam_krb5.so use_first_pass debug auth [default=done] pam_ccreds.so action=validate use_first_pass auth [default=done] pam_ccreds.so action=store auth [default=bad] pam_ccreds.so action=update And here they are along with the other PAM config files and auth.log in Ubuntu 8.10 after running "auth-client-config -a -p kerberos_example". Ubuntu 8.10... common-auth: ============ # # /etc/pam.d/common-auth - authentication settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authentication modules that define # the central authentication scheme for use on the system # (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the # traditional Unix authentication mechanisms. # # As of pam 1.0.1-5, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # pre_auth-client-config # # here are the per-package modules (the "Primary" block) # pre_auth-client-config # auth [success=1 default=ignore] pam_unix.so nullok_secure # pre_auth-client-config # # here's the fallback if no module succeeds # pre_auth-client-config # auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around # pre_auth-client-config # auth required pam_permit.so # pre_auth-client-config # # and here are more per-package modules (the "Additional" block) # pre_auth-client-config # # end of pam-auth-update config auth [authinfo_unavail=ignore success=1 default=2] pam_krb5.so use_first_pass ignore_root debug auth [success=done default=ignore] pam_unix.so nullok_secure debug auth [default=done] pam_ccreds.so action=validate use_first_pass auth [default=done] pam_ccreds.so action=store auth [default=bad] pam_ccreds.so action=update common-session: ============ # # /etc/pam.d/common-session - session-related modules common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of modules that define tasks to be performed # at the start and end of sessions of *any* kind (both interactive and # non-interactive). # # As of pam 1.0.1-5, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # pre_auth-client-config # # here are the per-package modules (the "Primary" block) # pre_auth-client-config # session [default=1] pam_permit.so # pre_auth-client-config # # here's the fallback if no module succeeds # pre_auth-client-config # session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around # pre_auth-client-config # session required pam_permit.so # pre_auth-client-config # # and here are more per-package modules (the "Additional" block) # pre_auth-client-config # session required pam_unix.so # pre_auth-client-config # session optional pam_ck_connector.so nox11 # pre_auth-client-config # # end of pam-auth-update config session required pam_mkhomedir.so umask=0022 skel=/etc/skel session optional pam_foreground.so session optional pam_krb5.so debug session required pam_unix.so debug common-password: ============ # # /etc/pam.d/common-password - password-related modules common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of modules that define the services to be # used to change user passwords. The default is pam_unix. # Explanation of pam_unix options: # # The "sha512" option enables salted SHA512 passwords. Without this option, # the default is Unix crypt. Prior releases used the option "md5". # # The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in # login.defs. # # See the pam_unix manpage for other options. # As of pam 1.0.1-5, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # pre_auth-client-config # # here are the per-package modules (the "Primary" block) # pre_auth-client-config # password [success=1 default=ignore] pam_unix.so obscure sha512 # pre_auth-client-config # # here's the fallback if no module succeeds # pre_auth-client-config # password requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around # pre_auth-client-config # password required pam_permit.so # pre_auth-client-config # # and here are more per-package modules (the "Additional" block) # pre_auth-client-config # # end of pam-auth-update config password sufficient pam_unix.so nullok obscure min=4 max=8 md5 debug password sufficient pam_krb5.so debug try_first_pass password required pam_deny.so common-account: ============ # # /etc/pam.d/common-account - authorization settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authorization modules that define # the central access policy for use on the system. The default is to # only deny service to users whose accounts are expired in /etc/shadow. # # As of pam 1.0.1-5, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # # pre_auth-client-config # # here are the per-package modules (the "Primary" block) # pre_auth-client-config # account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so # pre_auth-client-config # # here's the fallback if no module succeeds # pre_auth-client-config # account requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around # pre_auth-client-config # account required pam_permit.so # pre_auth-client-config # # and here are more per-package modules (the "Additional" block) # pre_auth-client-config # # end of pam-auth-update config account sufficient pam_krb5.so debug account sufficient pam_unix.so debug account required pam_permit.so /var/log/auth.log: ============ Jan 7 16:42:12 nin sshd[32175]: Invalid user lowmanp from 136.180.81.146 Jan 7 16:42:12 nin sshd[32175]: PAM unable to dlopen(/lib/security/pam_foreground.so): /lib/security/pam_foreground.so: cannot open shared object file: No such file or directory Jan 7 16:42:12 nin sshd[32175]: PAM adding faulty module: /lib/security/pam_foreground.so Jan 7 16:42:12 nin sshd[32175]: Failed none for invalid user lowmanp from 136.180.81.146 port 54620 ssh2 Jan 7 16:42:14 nin sshd[32175]: (pam_krb5): none: pam_sm_authenticate: entry (0x1) Jan 7 16:42:14 nin sshd[32175]: (pam_krb5): lowmanp: attempting authentication as [email protected] Jan 7 16:42:14 nin sshd[32175]: (pam_krb5): lowmanp: krb5_get_init_creds_password: Preauthentication failed Jan 7 16:42:14 nin sshd[32175]: (pam_krb5): lowmanp: pam_sm_authenticate: exit (failure) Jan 7 16:42:14 nin sshd[32175]: Failed password for invalid user lowmanp from 136.180.81.146 port 54620 ssh2 -- no kerberos support for pam-auth-update? https://bugs.launchpad.net/bugs/275169 You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
