Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am unexperienced in regard to pam, so forgive me if this is a obvious problem or I give the wrong information.

I have a gentoo server, I didn't configure. It does authentication via kerberos. The problem is, that one can log in on this server with an incorrect password and even do sudo. The log looks like this:

500 Jul 01 20:22:25 [sshd] pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myhost  user=roessler
501 Jul 01 20:22:25 [sshd] pam_krb5(sshd:auth): authentication failure; logname=roessler uid=0 euid=0 tty=ssh ruser= rhost=myhost
502 Jul 01 20:22:25 [sshd] Accepted keyboard-interactive/pam for roessler from <my-IP> port <my-Port> ssh2
503 Jul 01 20:22:25 [sshd] pam_unix(sshd:session): session opened for user roessler by (uid=0)
504 Jul 01 20:22:35 [sudo] pam_unix(sudo:auth): authentication failure; logname=roessler uid=0 euid=0 tty=/dev/pts/0 ruser=roessler rhost=  user=roessler
505 Jul 01 20:22:35 [sudo] pam_krb5(sudo:auth): authentication failure; logname=roessler uid=0 euid=0 tty=/dev/pts/0 ruser=roessler rhost=
506 Jul 01 20:22:35 [sudo] roessler : TTY=pts/0 ; PWD=/home/roessler ; USER=root ; COMMAND=/bin/su
507 Jul 01 20:22:35 [sudo] pam_unix(sudo:session): session opened for user root by roessler(uid=0)
508 Jul 01 20:22:35 [su] Successful su for root by root

I took a look at the corresponding pam config files. They point at one another, but eventually it boils down to:

1 auth            required onerr=succeed
2 auth            required
3 auth            required
4 auth            include         system-auth

and (system-auth)

1 auth            required
2 auth            required onerr=fail item=group sense=allow file=/etc/
3 auth            sufficient try_first_pass likeauth nullok
4 auth            sufficient use_first_pass debug
5 auth            optional

To me the first line of that config looks suspicious, but then there is another server with the same config which works just fine. This even makes me wonder whether I am looking in the right direction...

I appreciate any hints!

share|improve this question
up vote 6 down vote accepted

You say there is another server with the same config that works fine...but your auth is such that an incorrect unix and krb5 password falls through to pam_permit which always returns PAM_SUCCESS. That's bad. Instead of pam_permit it should be

auth        required
share|improve this answer
Thanks! Sometimes one needs someone else to point to the obvious... :-) – roesslerj Jul 2 '11 at 8:45
There is too many configs around the internet which do not include this line in their ldap setup guides. – Ryaner Nov 23 '11 at 12:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.