How do I switch on PAM debugging in Debian Squeeze at the admin level?
I have checked every resource I was able to find. Google, manpages, whatever. The only thing I haven't tried yet (I simply not dare to, did I mention that I hate PAM?) is digging into the PAM's library source.
I tried to google for a solution, nothing. What I found so far:
debug option on PAM entries in
Nope, does not work. No PAM output, nothing, absolute silence.
While searching for a solution I even followed links to Pam, that are gas stations here in Germany. Well, yes, perhaps in all those billion of hits might hiding a clue, but shoot me I'd be dead before I discover.
Rest is FYI:
What problem did I have?
After upgrading to Debian Squeeze something got weird (well, hey, it once was, uh, what was right over the Etch .. ah, yes, Woody). So it's probably not Debian's fault, just a long lived screwed up setup. I immediately had the impression it has to do something with PAM, but I really did not know what's going on. I was completely in the dark, left alone, helpless as a baby, YKWIM. Some ssh logins worked, some not. It was kind of funny. No clues in
ssh -v, no clues in
/var/log/*, nothing. Just "auth succeeded" or "auth fail", sometimes the same user logging in parallely succeeded with one session and failed with the other, at the same time. And nothing you really can get hold of.
After digging trainloads of other options I was able to find out. There is
nullok_secure, a Debian special. Something screwed with
/etc/securetty and depending on the
tty (which is somewhat random) a login was rejected or not. REALLY NICE, phew!
The fix was easy and everything's now fine again.
However this left me with the question, how to debug such a mess in future. It's not the first time PAM drives me nuts. So I would like to see a final solution. Final as in "solved", not final as in "armageddon". Thanks.
Ah, BTW, this again strengthened my belief in that it's good to hate PAM since it came up. Did I mention that I do?