In our environment we do not join Linux boxes to the Microsoft Domain. We do however setup Kerberos. This allows us to log into the boxes using our AD credentials as long as there is a local account with the same name. However, when I use sudo it only accepts my local credentials. How can I use my AD password with sudo? Thanks.

  • 1
    How exactly did you "setup Kerberos"? Feb 27 '14 at 14:44
  • 1
    Just created a krb5.conf file Feb 27 '14 at 15:04
  • 1
    did you configured /etc/pam.d/sudo to use pam_krb5.so? distro are you using?
    – c4f4t0r
    Feb 27 '14 at 15:06
  • Hmm I'll have to check. Good point. Feb 27 '14 at 15:08
  • @ChrisJones i missed you are using redhat, try with authconfig --enablekrb5 --updateall
    – c4f4t0r
    Feb 27 '14 at 15:33

Seems like it's a PAM configuration issue. I have a similar setup on our Linux servers---Kerberos authentication against our AD DCs.

Below are the relevant PAM files for comparison.

First, system-auth PAM config which the sudo config depends on:

# cat /etc/pam.d/system-auth
auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_krb5.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_krb5.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_krb5.so

As you could see, this includes the pam_krb5.so module used for Kerberos.

The sudo PAM config files include system-auth and look like this:

# cat /etc/pam.d/sudo
auth       include      system-auth
account    include      system-auth
password   include      system-auth
session    optional     pam_keyinit.so revoke
session    required     pam_limits.so

# cat /etc/pam.d/sudo-i
auth       include      sudo
account    include      sudo
password   include      sudo
session    optional     pam_keyinit.so force revoke
session    required     pam_limits.so

PAM could be very powerful but it took me a bit to get my head wrapped around it. Red Hat's documentation helped me out a lot when dealing with PAM issues.

  • All this is fine, but you really need to have a host keytab on the machine. If you don't then the security of kerberos is compromised and can be spoofed with MITM attacks. Mar 25 '14 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.