1

I'm trying to configure pam with the following requests :

  • You can log with local account(root, local users)
  • You can log with AD accounts and if you do, pam mount home share
  • You can log with AD account through cache credentials (ccreds) if AD isn't accessible, and if you do, pam don't try to mount home share

So far I almost manage to configure pam that way but when I log on AD account when it isn't accessible, pam is trying to mount home share which isn't accessible as well.

I think I got how pam config files works and I tested a lot of different things, So if an pam expert would like to help I'll be very thankful

Here are the pam config files :

/etc/pam.d/common-auth

# here are the per-package modules (the "Primary" block)
auth    [success=4 default=ignore]      pam_unix.so nullok_secure
auth    [success=2 default=ignore]      pam_winbind.so krb5_auth         krb5_ccache_type=FILE cached_login try_first_pass
auth    [success=2 default=ignore]      pam_ccreds.so minimum_uid=1000 action=validate use_first_pass
#               auth    [success=2 default=ignore]              pam_ccreds.so minimum_uid=1000 action=update
# here's the fallback if no module succeeds
auth    requisite                       pam_deny.so
auth    optional                        pam_mount.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional                        pam_ccreds.so minimum_uid=1000 action=store
# end of pam-auth-update config

/etc/pam.d/common-session

# here are the per-package modules (the "Primary" block)
session [default=1]                     pam_permit.so
# here's the fallback if no module succeeds
session requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required                        pam_unix.so
session [success=ok default=1]          pam_winbind.so
session [success=done default=ignore]   pam_mount.so
session sufficient                      pam_ccreds.so
# end of pam-auth-update config

/etc/pam.d/common-session-noninterractive

session [default=1]                     pam_permit.so
# here's the fallback if no module succeeds
session requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required        pam_unix.so
session sufficient      pam_ccreds.so

If you need more information don't hesitate to ask. Thank you in advance.

  • I'm trying to debug the authentication thanks to pam_exec.so by writing my "own" log and I find out that the winbind.so module is the source of my problems. It seems like that winbind.so recognize the user and try to log him through AD. I need to have a timeout with this step. Anyone knows how to do that? – gauth May 23 '17 at 15:41
1

I manage to do what I wanted to do using pam_exec.so module to check if the ActiveDirectory server was joinable or not. Here are the pam files :

/etc/pam.d/common-auth

 auth    optional                        pam_exec.so log=/var/tmp/pam.log  /bin/echo "-----AUTH------"
auth    [success=5 default=ignore]      pam_unix.so nullok_secure
auth    [success=3 authinfo_unavail=ignore  default=1]  pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
auth    [success=4 default=ignore]      pam_ccreds.so minimum_uid=1000 action=validate use_first_pass
auth    [success=die default=die]               pam_ccreds.so minimum_uid=1000 action=update
# here's the fallback if no module succeeds
auth    requisite                       pam_deny.so
auth    [success=1 default=die]                 pam_ccreds.so minimum_uid=1000 action=store
auth    [success=4 default=die]                  pam_exec.so log=/var/tmp/pam.log  /bin/echo "sucessfully log with unix"
session [success=ok default=2]          pam_exec.so log=/var/tmp/script.log  /bin/ping  -c 1 ipaddress.to.AD.server
auth    optional        pam_mount.so
auth    [success=1 default=die]                  pam_exec.so log=/var/tmp/pam.log  /bin/echo "sucessfully log with winbind"
auth    [default=die]                            pam_exec.so log=/var/tmp/pam.log  /bin/echo "sucessfully log with ccreds"
auth    required                        pam_permit.so

/etc/pam.d/common-account

account optional                        pam_exec.so log=/var/tmp/pam.log  /bin/echo "-----ACCOUNT------"
account [success=ok new_authtok_reqd=done default=1]    pam_unix.so
account [success=3]                     pam_exec.so log=/var/tmp/pam.log  /bin/echo "Logged with Unix account"
account [success=1 new_authtok_reqd=done default=ignore]        pam_winbind.so
account requisite                       pam_deny.so
account optional                        pam_exec.so log=/var/tmp/pam.log  /bin/echo "Logged with winbind account"
account required                        pam_permit.so

/etc/pam.d/common-session

session    optional                             pam_exec.so log=/var/tmp/pam.log  /bin/echo "-----SESSION------"
session [default=1]                     pam_permit.so
session requisite                       pam_deny.so
session required                        pam_permit.so
session [success=ok default=1]  pam_unix.so
session [success=ok]            pam_exec.so log=/var/tmp/pam.log  /bin/echo "unix session started"
session [success=ok default=die]        pam_winbind.so
session required        pam_mkhomedir.so skel=/etc/skel/ umask=0077
session [success=ok default=2]          pam_exec.so log=/var/tmp/script.log  /bin/ping  -c 1 ipaddress.to.AD.server
session optional        pam_mount.so
session [success=done]  pam_exec.so log=/var/tmp/pam.log  /bin/echo "winbind session started + homedir mounted"
session optional        pam_exec.so log=/var/tmp/pam.log  /bin/echo "ccreds session started"

You just have to change the IP address in auth and session file to get it working. You will have personalized log in /var/tmp/ for the pings and echos. I think there are better solutions than mine to resolve that problem but I didn't find it.

Hope these conf files will help some people!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.