<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12px"><div id="yui_3_16_0_1_1419230579287_4285"><span></span></div><div id="yui_3_16_0_1_1419230579287_4297" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 12px;"><div id="yui_3_16_0_1_1419230579287_4296" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif; font-size: 12px;"><br><div id="yui_3_16_0_1_1419230579287_4299" class="y_msg_container"><span id="yui_3_16_0_1_1419230579287_4302">Hello Tomas,</span><div id="yiv6264906875"><div id="yui_3_16_0_1_1419230579287_4305"><div id="yui_3_16_0_1_1419230579287_4304" style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12px;"><div id="yui_3_16_0_1_1419230579287_4303" dir="ltr"><br clear="none"><span></span></div><div id="yui_3_16_0_1_1419230579287_4307" dir="ltr"><div id="yui_3_16_0_1_1419230579287_4572"><span id="yui_3_16_0_1_1419230579287_4306">Really appreciate for your quick response on this. And apologies if I am asking repeated questions.<br></span></div><div id="yui_3_16_0_1_1419230579287_4571"><span id="yui_3_16_0_1_1419230579287_4306"><br></span></div><div id="yui_3_16_0_1_1419230579287_4570"><span id="yui_3_16_0_1_1419230579287_4306">I am seeing this behavior on default login service which come with RHEL 6.x installation. I have not modified the same.</span> Below is the configuration for same.</div><div id="yui_3_16_0_1_1419230579287_4573"><br></div></div><span id="yui_3_16_0_1_1419230579287_4309"></span><div id="yui_3_16_0_1_1419230579287_4311" dir="ltr"><div dir="ltr" id="yui_3_16_0_1_1419230579287_4319">[myuser@myhost ~]$ cat /etc/pam.d/login<br style="" class="">#%PAM-1.0<br style="" class="">auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so<br style="" class="">auth include system-auth<br style="" class="">account required pam_nologin.so<br style="" class="">account include system-auth<br style="" class="">password include system-auth<br style="" class=""># pam_selinux.so close should be the first session rule<br style="" class="">session required pam_selinux.so close<br style="" class="">session required pam_loginuid.so<br style="" class="">session optional pam_console.so<br style="" class=""># pam_selinux.so open should only be followed by sessions to be executed in the user context<br style="" class="">session required pam_selinux.so open<br style="" class="">session required pam_namespace.so<br style="" class="">session optional pam_keyinit.so force revoke<br style="" class="">session include system-auth<br style="" class="">-session optional pam_ck_connector.so</div><div id="yui_3_16_0_1_1419230579287_4410" dir="ltr"><br></div><div id="yui_3_16_0_1_1419230579287_4434" dir="ltr">Do you still recommend to recheck with only "auth required pam_permit.so" ?</div><div id="yui_3_16_0_1_1419230579287_4436" dir="ltr"><br></div><div id="yui_3_16_0_1_1419230579287_4437" dir="ltr">To understand the API I was referring to the online documentation for linux-pam. (http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_authenticate)<br></div><div id="yui_3_16_0_1_1419230579287_4345" style="" class="" dir="ltr"><br></div><div id="yui_3_16_0_1_1419230579287_4564" style="" class="" dir="ltr">On the same page in "What can be expected by the application" under "3.1.1.1. DESCRIPTION" below is mentioned.<br></div><div id="yui_3_16_0_1_1419230579287_4565" style="" class="" dir="ltr"><br style="" class="" clear="none">The <span id="yui_3_16_0_1_1419230579287_4562" style="" class=""><em id="yui_3_16_0_1_1419230579287_4561" style="" class="">pam_handle_t</em></span> is a blind structure and
the application should not attempt to probe it directly for
information. Instead the PAM library provides the functions
<span id="yui_3_16_0_1_1419230579287_4560" style="" class=""><span id="yui_3_16_0_1_1419230579287_4559" style="" class="">pam_set_item</span>(3)</span> and
<span id="yui_3_16_0_1_1419230579287_4558" style="" class=""><span id="yui_3_16_0_1_1419230579287_4557" style="" class="">pam_get_item</span>(3)</span>.
The PAM handle cannot be used for mulitiple authentications at the
same time as long as <code style="" class="">pam_end</code> was not called on
it before.
</div><div id="yui_3_16_0_1_1419230579287_4345" style="" class="" dir="ltr"><br><span style="" class=""></span></div><div id="yui_3_16_0_1_1419230579287_4566" style="" class="" dir="ltr"><span id="yui_3_16_0_1_1419230579287_4567" style="" class="">To me this implies that if pam_end is not called the same handle can be reused. Can you please reconfirm if the understanding is correct.<br style="" class="" clear="none"></span></div></div><div dir="ltr"><span></span></div><div id="yiv6264906875yui_3_16_0_1_1419230579287_2602"> </div><div class="yiv6264906875signature" id="yiv6264906875yui_3_16_0_1_1419230579287_2601"><div dir="ltr" id="yiv6264906875yui_3_16_0_1_1419230579287_2600" style="MARGIN-RIGHT:0px;FONT-FAMILY:verdana, helvetica, sans-serif;" align="left"><span style="" lang="en-us"><font face="Verdana" size="1" color="#808080"><b><br clear="none">Thanks & Regards,</b></font></span><span id="yiv6264906875yui_3_16_0_1_1419230579287_2599" lang="en-us"><font id="yui_3_16_0_1_1419230579287_4613" face="Verdana"> <br clear="none"></font><b><font face="Verdana" size="1" color="#0000ff">MINAL PATIL</font></b><font face="Verdana"><br clear="none"></font><br></span></div></div><br clear="none"> <div class="qtdSeparateBR"><br><br></div><div class="yiv6264906875yqt1328476167" id="yiv6264906875yqt20311"><div id="yiv6264906875yui_3_16_0_1_1419230579287_2539" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12px;"> <div id="yiv6264906875yui_3_16_0_1_1419230579287_2538" style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12px;"> <div dir="ltr" id="yiv6264906875yui_3_16_0_1_1419230579287_2537"> <hr id="yiv6264906875yui_3_16_0_1_1419230579287_2696" size="1"> <font id="yiv6264906875yui_3_16_0_1_1419230579287_2536" face="Arial" size="2"> <b><span style="font-weight:bold;">From:</span></b> Tomas Mraz <tmraz@redhat.com><br clear="none"> <b><span style="font-weight:bold;">To:</span></b> Minal Patil <minalk.patil@yahoo.com>; Pluggable Authentication Modules <pam-list@redhat.com> <br clear="none"> <b><span style="font-weight:bold;">Sent:</span></b> Friday, 19 December 2014 5:01 PM<br clear="none"> <b><span style="font-weight:bold;">Subject:</span></b> Re: delay observed in pam_authenticate when called multiple times.<br clear="none"> </font> </div> <div class="yiv6264906875y_msg_container" id="yiv6264906875yui_3_16_0_1_1419230579287_2607"><br clear="none">On Pá, 2014-12-19 at 09:06 +0000, Minal Patil wrote:<div id="yui_3_16_0_1_1419230579287_4348" class="yiv6264906875qtdSeparateBR"><br clear="none"><br clear="none"></div><div class="yiv6264906875yqt9960173021" id="yiv6264906875yqtfd56392"><br clear="none">> Hello Sir/Madam,<br clear="none">> I am working on a PAM authentication module where i am seeing delay in pam_authenticate when called in sucessive manner.Below is my PAM function call sequence.<br clear="none">> pam_start()<br clear="none">> ...<br clear="none">> 1. pam_authenticate()<br clear="none">> 2. pam_authenticate()<br clear="none">> 3. pam_authenticate()<br clear="none">> <br clear="none">> 4. pam_authenticate()<br clear="none">> <br clear="none">> ....<br clear="none">> <br clear="none">> 1000.pam_authenticate()<br clear="none">> ....<br clear="none">> pam_end()<br clear="none">> <br clear="none">> It is observed that the first pam_authenticate responds with 40 ms. The response time goes up with every subsequent pam_authenticate call. for 1000 the call the response time is observed to be 2 seconds.<br clear="none">> <br clear="none">> Below are my system details:<br clear="none">> <br clear="none">> [<a rel="nofollow" shape="rect" ymailto="mailto:myuser@myhost" target="_blank" href="mailto:myuser@myhost">myuser@myhost</a> workdir]$ ls -l /lib/libpam*<br clear="none">> lrwxrwxrwx. 1 root root 17 Oct 18 2013 /lib/libpamc.so.0 -> libpamc.so.0.82.1<br clear="none">> -rwxr-xr-x. 1 root root 13764 Oct 15 2012 /lib/libpamc.so.0.82.1<br clear="none">> lrwxrwxrwx. 1 root root 21 Oct 18 2013 /lib/libpam_misc.so.0 -> libpam_misc.so.0.82.0<br clear="none">> -rwxr-xr-x. 1 root root 11460 Oct 15 2012 /lib/libpam_misc.so.0.82.0<br clear="none">> lrwxrwxrwx. 1 root root 16 Oct 18 2013 /lib/libpam.so.0 -> libpam.so.0.82.2<br clear="none">> -rwxr-xr-x. 1 root root 52540 Oct 15 2012 /lib/libpam.so.0.82.2<br clear="none">> [<a rel="nofollow" shape="rect" ymailto="mailto:myuser@myhost" target="_blank" href="mailto:myuser@myhost">myuser@myhost</a> workdir]$ uname -a<br clear="none">> Linux myhost 2.6.32-358.18.1.el6.i686 #1 SMP Fri Aug 2 17:10:27 EDT 2013 i686 i686 i386 GNU/Linux<br clear="none">> [<a rel="nofollow" shape="rect" ymailto="mailto:myuser@myhost" target="_blank" href="mailto:myuser@myhost">myuser@myhost</a> workdir]$ cat /etc/redhat-release<br clear="none">> Red Hat Enterprise Linux Server release 6.4 (Santiago)<br clear="none">> <br clear="none">> I have observed the same behavior on RHEL 6.2 as well. </div><br clear="none">> <a rel="nofollow" shape="rect" id="yiv6264906875yui_3_16_0_1_1419230579287_2689" target="_blank" href="https://www.redhat.com/mailman/listinfo/pam-list">https://www.redhat.com/mailman/listinfo/pam-list</a><br clear="none"><br clear="none">Which PAM modules do you have configured in the PAM stack? Do you<br clear="none">observe the same behavior even with PAM stack containing a single:<br clear="none"><br clear="none">auth required pam_permit.so<br clear="none"><br clear="none">If not, you have to find out which PAM module causes the delay although<br clear="none">I suppose this can be multiple modules as PAM stack was not designed to<br clear="none">operate this way. You should always call pam_start() pam_authenticate()<br clear="none">and pam_end().<br clear="none"><br clear="none">-- <br clear="none">Tomas Mraz<br clear="none">No matter how far down the wrong road you've gone, turn back.<br clear="none"> Turkish proverb<br clear="none">(You'll never know whether the road is wrong though.)<div class="yiv6264906875yqt9960173021" id="yiv6264906875yqtfd48520"><br clear="none"><br clear="none"><br clear="none"></div><br clear="none"><br clear="none"></div> </div> </div></div> </div></div></div><br><br></div> </div> </div> </div></body></html>