2

I want to implement conditions for PAM_TYPE open_session and close_session. With this I can trigger different actions at different times for login and logout.

I have a script which tests for the variable PAM_TYPE and give appropriate exit codes: exit 0 for success and exit 1 otherwise.

But I get weird problems with the assembly; pam_exec don't get the right exit codes from the script.

Here is my implementation for testing:

In /etc/pam.d/common-session I have added:

session [success=ignore default=1] pam_exec.so debug seteuid /usr/sbin/test.sh logout
session optional        pam_exec.so debug log=/tmp/test_pam.txt /bin/echo "logout reached"
session [success=1 default=ignore] pam_exec.so debug seteuid /usr/sbin/test.sh logout
session optional        pam_exec.so  debug log=/tmp/test_pam.txt /bin/echo "login reached"

The script /usr/sbin/test.sh is

#!/bin/bash
# some actions
# invocted by pam_exec.so

echo $PAM_TYPE
case $1 in
logout)
  if [ $PAM_TYPE == "close_session" ]; then echo $PAM_TYPE; exit 0; else exit 1; fi
  ;;
esac

When I make a su to an user and immediately a logout I get in the log-file

$ cat /tmp/test_pam.txt 
*** Mon Jun  3 12:14:07 2019
"login reached"
*** Mon Jun  3 12:15:00 2019
"login reached"

This behavior is weird. The last line must be logout reached.
So Pam takes every time the condition to false. But for testing I have placed echo $PAM_TYPE; in the true-condition and this echo is displayed in the terminal by logout. So the if Statement leads to true with exit 0 but pam_exec takes it as false.

Has someone an idea what is going wrong?

Thanks in advance,

Helge

2
  • Aren't you ignoring logout via success=ignore?
    – oxr463
    Jun 5, 2019 at 15:27
  • No, ignore means no action, continue; default=1 means for anything else (other than success) skip 1 line.
    – OJFord
    May 3, 2021 at 14:36

2 Answers 2

1

I have this answer from another site:

You cannot depend on jumps in PAM stack in the close_session calls. The pam module stack is "frozen" in the open_session and identical modules in the same order are invoked in the close_session call.

The behavior of my scripts is now clear: My approach is not possible!

2
  • Did you find another way to achieve this?
    – OJFord
    May 3, 2021 at 14:35
  • @OJFord No :-( (Comments must be at least 15 chars - so I write this ;-) )
    – h___m
    May 4, 2021 at 20:34
0

in /etc/pam.d/sshd

session required pam_exec.so /etc/pam_scripts/pam_exec.sh

where pam_exec.sh has something like

if [ "$PAM_TYPE" == "open_session" ] && [ "$PAM_USER" != "root" ]; then

..do something

else

..do something else

fi

exit 0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .