<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8"> <TITLE>Granting su rights to users? Using PAM and Kerberos...</TITLE> <META content="MSHTML 6.00.2800.1522" name=GENERATOR></HEAD> <BODY dir=ltr> <BLOCKQUOTE dir=ltr style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px"> <DIV class=OutlookMessageHeader dir=ltr align=left><FONT face=Tahoma size=2>-----Original Message-----<BR><B>From:</B> Bohmer, Andre ten [mailto:fedora-list-bounces@redhat.com]<B>On Behalf Of </B>Bohmer, Andre ten<BR><B>Sent:</B> Monday, November 21, 2005 1:43 PM<BR><B>To:</B> For users of Fedora Core releases<BR><B>Subject:</B> RE: Granting su rights to users? Using PAM and Kerberos...<BR><BR></FONT></DIV> <DIV>Hi,</DIV> <DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV> <DIV>Maybe you have to enable <FONT size=-1><B>local authorization sufficient</B></FONT> in order to use su? We're using kerberos v5 to authenticate Linux accounts against Active Directory, and had a similar problem on Red Hat EL AS 4.</DIV> <DIV>Sorry for the very bad quoting, using OWA ...</DIV> <DIV><FONT face=Arial color=#0000ff size=2></FONT> </DIV> <DIV>Cheers,</DIV> <DIV>Andre<SPAN class=174364823-21112005><FONT face=Arial color=#0000ff size=2> </FONT></SPAN></DIV></BLOCKQUOTE> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005></SPAN></FONT></FONT></FONT> </DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>Hmm... What do you mean by 'local authorization sufficient' ?</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005></SPAN></FONT></FONT></FONT> </DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>What I noticed was in /var/log/krb5kdc.log is that it was reporting a lot</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>of <A href="mailto:root@REALM">root@REALM</A> principal was missing in the database so I added the</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>root principal and </SPAN></FONT></FONT></FONT><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>that appeared to make the log a bit more quieter but</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>the su root problem </SPAN></FONT></FONT></FONT><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>still remains.</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005></SPAN></FONT></FONT></FONT> </DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>I am guessing that somewhere I will need to allow user root access with</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>kerberos as the googles mentioned it for kerberos IV (kdb_edit) but does</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>not say anything about kerberos 5 so I am assuming that kdb_edit is</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>depreciated and something else takes it's place?</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005></SPAN></FONT></FONT></FONT> </DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>Another person who responded asked me to check /etc/pam.d/su but</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>I cannot tell what I am supposed to look at. I will need to check to see</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>if kerberos entries needs to be in there since I was some instructions</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>from <A href="http://www.ofb.net/~jheiss/krbldap/howto.html">http://www.ofb.net/~jheiss/krbldap/howto.html</A> mentions to add</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>kerberos support to /etc/pam/system-auth but nothing about /etc/pam.d/su ...</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005></SPAN></FONT></FONT></FONT> </DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>Any pointers, links, howtos, or whatever is appreciated!</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005></SPAN></FONT></FONT></FONT> </DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>Thanks!</SPAN></FONT></FONT></FONT></DIV> <DIV dir=ltr><FONT face=Arial><FONT size=2><FONT color=#0000ff><SPAN class=174364823-21112005>Dan</SPAN></FONT></FONT></FONT></DIV></BODY></HTML> <BR> <P><FONT SIZE=2>--<BR> No virus found in this outgoing message.<BR> Checked by AVG Free Edition.<BR> Version: 7.1.362 / Virus Database: 267.13.4/176 - Release Date: 11/20/2005<BR> </FONT> </P>