0

I am configuring a web service for PAM authentication. In addition to kerberos, it should also allow a couple of additional local users to authenticate.

I am using 65534 (nobody) for these users to ensure they don't gain any unforseen access. Both the passwd and shadow files are readable by the service.

/etc/pam.d/myservice

auth     required   pam_listfile.so onerr=fail item=user sense=allow file=/etc/myservice/users

auth     sufficient pam_krb5.so minimum_uid=1000
account  sufficient pam_krb5.so minimum_uid=1000

auth     sufficient pam_extrausers.so
account  sufficient pam_extrausers.so

/var/lib/extrausers/passwd

user1:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
user2:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin

/var/lib/extrausers/shadow

user1:$6$FUa_ɹ$06eDsFUm06fx6zrJQhTMQNJsPbpY1ITrmFXpVFPIoKQGvWQ8Fm0u3SkAayY96ZaSLSvm7txaEtwQQDxU5Nm6G0:18045:0:99999:7:::
user2:$6$awO$msWKKUF1C2kFKvcV27oG/Lcni/ZiAVJyiHuIko4feYAj97iNMdmY8/h6xBZTFUWLerkgnvOHWPDq1o8JY6crO.:18045:0:99999:7:::

/var/log/auth.log

May 29 13:37:41 myhost pam_extrausers_chkpwd[493]: check pass; user unknown
May 29 13:37:41 myhost pam_extrausers_chkpwd[493]: password check failed for user (user1)
May 29 13:37:41 myhost ker process: pam_extrausers(myservice:auth): authentication failure; logname= uid=33 euid=33 tty= ruser= rhost= user=user1
May 29 13:37:41 myhost pam_extrausers_chkpwd[494]: could not obtain user info (user1)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.