I have the following situation: I have a server running RHEL 7.4. This server's main purpose is to host an RStudio Server Pro instance, which allows users to connect to a kerberized Hadoop cluster in a different realm to leverage its distributed computing capabilities.

This works fine if user opens an R session in RStudio IDE and runs system("kinit -kt /path/to/keytab username"). With this call user is able to obtain and cache a Kerberos ticket.

I'm now wondering how I could free users from running this command and offer a behind-the-scenes solution.

Currently, users are authenticated by PAM. I'm aware of the Kerberos service module for PAM pam_krb5 but I don't really understand how I should configure my existing rstudio profile:

auth    [user_unknown=ignore success=ok ignore=ignore default=bad]      pam_securetty.so
auth    substack        system-auth
auth    include postlogin
account required        pam_nologin.so
account include system-auth
password        include system-auth
# pam_selinux.so close should be the first session rule
session required        pam_selinux.so close
session required        pam_loginuid.so
session optional        pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required        pam_selinux.so open
session required        pam_namespace.so
session optional        pam_keyinit.so force revoke
session include system-auth
session include postlogin
-session        optional        pam_ck_connector.so

I have read the RStudio documentation on Kerberos but it doesn't tell me how I can authenticate users via keytabs on a server in a different Kerberos realm (cross realm authentication?).

How should my RStudio PAM profile look like to achieve this?

Edit: Adding system-auth

# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth    required        pam_env.so
auth    required        pam_faillock.so preauth audit silent deny=5 unlock_time=900
auth    sufficient      pam_vas3.so create_homedir get_nonvas_pass try_first_pass
auth    requisite       pam_vas3.so echo_return
auth    sufficient      pam_unix.so likeauth nullok use_first_pass
auth    [default=die]   pam_faillock.so authfail audit deny=5 unlock_time=900
auth    sufficient      pam_faillock.so authsucc audit deny=5 unlock_time=900
auth    [success=1 default=bad] pam_unix.so
auth    sufficient      pam_krb5.so use_first_pass
#auth   sufficient      pam_winbind.so use_first_pass
auth    required        pam_deny.so

account sufficient      pam_vas3.so
account requisite       pam_vas3.so echo_return
account required        pam_unix.so broken_shadow
account required        pam_faillock.so
account sufficient      pam_succeed_if.so uid < 100 quiet
account sufficient      pam_succeed_if.so user ingroup UNIX_ADMINISTRATORS
account sufficient      pam_succeed_if.so user ingroup UNIX_OPERATORS
account sufficient      pam_succeed_if.so user ingroup TSM_ADMINISTRATORS
account sufficient      pam_succeed_if.so user ingroup smadming
account required        pam_succeed_if.so user ingroup SERVER_STAFF
account optional        /lib64/security/pam_krb5.so
account required        pam_permit.so

password        requisite       pam_pwquality.so try_first_pass retry=3 retry=3 minlen=8 lcredit=-1 ucredit=-1 ocredit=-1 dcredit=-1 difok=4
password        sufficient      pam_vas3.so
password        requisite       pam_vas3.so echo_return
password        sufficient      pam_unix.so nullok use_authtok md5 shadow remember=15
password        sufficient      pam_krb5.so use_authtok
#password       sufficient      pam_winbind.so use_authtok
password        required        pam_deny.so

session required        pam_mkhomedir.so skel=/etc/skel/ umask=0077
session required        pam_limits.so
session required        pam_vas3.so create_homedir
session requisite       pam_vas3.so echo_return
session required        pam_unix.so
session optional        pam_krb5.so
  • How are accounts currently maintained (AD,Samba,IdM)? Do your users enter a password when logging into rstudio? What does system-auth contain?
    – 84104
    May 3 '18 at 2:17
  • User accounts are maintained via AD and yes, users enter password for logging in. I edited the question to add system-auth.
    – xeroqu
    May 7 '18 at 6:57
  • Were you able to resolve this issue for cross realm authentication for hadoop keytab
    – SaiUday
    Jan 27 '20 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.