pam authentication failure, yet sudo and ssh work

Question

I am unexperienced in regard to pam, so forgive me if this is a obvious problem or I give the wrong information.

I have a gentoo server, I didn't configure. It does authentication via kerberos. The problem is, that one can log in on this server with an incorrect password and even do sudo. The log looks like this:

500 Jul 01 20:22:25 [sshd] pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myhost  user=roessler
501 Jul 01 20:22:25 [sshd] pam_krb5(sshd:auth): authentication failure; logname=roessler uid=0 euid=0 tty=ssh ruser= rhost=myhost
502 Jul 01 20:22:25 [sshd] Accepted keyboard-interactive/pam for roessler from <my-IP> port <my-Port> ssh2
503 Jul 01 20:22:25 [sshd] pam_unix(sshd:session): session opened for user roessler by (uid=0)
504 Jul 01 20:22:35 [sudo] pam_unix(sudo:auth): authentication failure; logname=roessler uid=0 euid=0 tty=/dev/pts/0 ruser=roessler rhost=  user=roessler
505 Jul 01 20:22:35 [sudo] pam_krb5(sudo:auth): authentication failure; logname=roessler uid=0 euid=0 tty=/dev/pts/0 ruser=roessler rhost=
506 Jul 01 20:22:35 [sudo] roessler : TTY=pts/0 ; PWD=/home/roessler ; USER=root ; COMMAND=/bin/su
507 Jul 01 20:22:35 [sudo] pam_unix(sudo:session): session opened for user root by roessler(uid=0)
508 Jul 01 20:22:35 [su] Successful su for root by root

I took a look at the corresponding pam config files. They point at one another, but eventually it boils down to:

1 auth            required        pam_tally2.so onerr=succeed
2 auth            required        pam_shells.so
3 auth            required        pam_nologin.so
4 auth            include         system-auth

and (system-auth)

1 auth            required        pam_env.so
2 auth            required        pam_listfile.so onerr=fail item=group sense=allow file=/etc/login.group.allowed
3 auth            sufficient      pam_unix.so try_first_pass likeauth nullok
4 auth            sufficient      pam_krb5.so use_first_pass debug
5 auth            optional        pam_permit.so

To me the first line of that config looks suspicious, but then there is another server with the same config which works just fine. This even makes me wonder whether I am looking in the right direction...

I appreciate any hints!

Answer 1

You say there is another server with the same config that works fine...but your auth is such that an incorrect unix and krb5 password falls through to pam_permit which always returns PAM_SUCCESS. That's bad. Instead of pam_permit it should be

auth        required      pam_deny.so