Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am unexperienced in regard to pam, so forgive me if this is a obvious problem or I give the wrong information.

I have a gentoo server, I didn't configure. It does authentication via kerberos. The problem is, that one can log in on this server with an incorrect password and even do sudo. The log looks like this:

500 Jul 01 20:22:25 [sshd] pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=myhost  user=roessler
501 Jul 01 20:22:25 [sshd] pam_krb5(sshd:auth): authentication failure; logname=roessler uid=0 euid=0 tty=ssh ruser= rhost=myhost
502 Jul 01 20:22:25 [sshd] Accepted keyboard-interactive/pam for roessler from <my-IP> port <my-Port> ssh2
503 Jul 01 20:22:25 [sshd] pam_unix(sshd:session): session opened for user roessler by (uid=0)
504 Jul 01 20:22:35 [sudo] pam_unix(sudo:auth): authentication failure; logname=roessler uid=0 euid=0 tty=/dev/pts/0 ruser=roessler rhost=  user=roessler
505 Jul 01 20:22:35 [sudo] pam_krb5(sudo:auth): authentication failure; logname=roessler uid=0 euid=0 tty=/dev/pts/0 ruser=roessler rhost=
506 Jul 01 20:22:35 [sudo] roessler : TTY=pts/0 ; PWD=/home/roessler ; USER=root ; COMMAND=/bin/su
507 Jul 01 20:22:35 [sudo] pam_unix(sudo:session): session opened for user root by roessler(uid=0)
508 Jul 01 20:22:35 [su] Successful su for root by root

I took a look at the corresponding pam config files. They point at one another, but eventually it boils down to:

1 auth            required        pam_tally2.so onerr=succeed
2 auth            required        pam_shells.so
3 auth            required        pam_nologin.so
4 auth            include         system-auth

and (system-auth)

1 auth            required        pam_env.so
2 auth            required        pam_listfile.so onerr=fail item=group sense=allow file=/etc/login.group.allowed
3 auth            sufficient      pam_unix.so try_first_pass likeauth nullok
4 auth            sufficient      pam_krb5.so use_first_pass debug
5 auth            optional        pam_permit.so

To me the first line of that config looks suspicious, but then there is another server with the same config which works just fine. This even makes me wonder whether I am looking in the right direction...

I appreciate any hints!

share|improve this question

1 Answer 1

up vote 6 down vote accepted

You say there is another server with the same config that works fine...but your auth is such that an incorrect unix and krb5 password falls through to pam_permit which always returns PAM_SUCCESS. That's bad. Instead of pam_permit it should be

auth        required      pam_deny.so
share|improve this answer
    
Thanks! Sometimes one needs someone else to point to the obvious... :-) –  roesslerj Jul 2 '11 at 8:45
    
There is too many configs around the internet which do not include this line in their ldap setup guides. –  Ryaner Nov 23 '11 at 12:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.