[389-users] PAM PTA partially working

[Rich Megginson]

Prashanth Sundaram wrote:
> Here is my /etc/pam.d/ldapserver
>
> auth        sufficient    /lib/security/pam_krb5.so use_first_pass
> forwardable
>
> password    sufficient    /lib/security/pam_krb5.so use_authtok
>
> session     optional      /lib/security/pam_krb5.so
>
> account     sufficient    /lib/security/pam_krb5.so
> ~
> ~
>
>
> To revisit, here's the observation: pamsecure when set to TRUE authenticates
> users only to the password in 389-ds, but when set to FALSE will
> authenticate to the AD password only if the uid exists in /etc/passwd.
>   
That's really bizarre - the only place where pamSecure is used is here:
    if (cfg->pamptconfig_secure) { /* is a secure connection required? */
        int is_ssl = 0;
        slapi_pblock_get(pb, SLAPI_CONN_IS_SSL_SESSION, &is_ssl);
        if (!is_ssl) {
            slapi_log_error( SLAPI_LOG_PLUGIN, 
PAM_PASSTHRU_PLUGIN_SUBSYSTEM,
                             "<= connection not secure (secure 
connection required; check config)");
            return retcode;
        }
    }
That is, if pamSecure is true, requests will be rejected unless using 
TLS/SSL.  Do you have your directory server configured to use TLS/SSL 
when using pamSecure: TRUE?
>
> On 9/22/09 10:36 AM, "Rich Megginson" <rmeggins at redhat.com> wrote:
>
>   
>> Prashanth Sundaram wrote:
>>     
>>> The account in /etc/passwd..
>>>       
>> Seems like a pam problem and/or misconfiguration then - if it finds the
>> entry using pam_krb5, it should never look at /etc/passwd.
>>     
>>> ------------------------------------------------------------------------
>>> Prashanth Sundaram wrote:
>>>
>>>
>>>     Yes, it works when there is a matching local user account.
>>>
>>> do you mean an account in /etc/passwd?  or an account in LDAP?
>>>
>>>     ------------------------------------------------------------------------
>>>
>>>     --
>>>     389 users mailing list
>>>     389-users redhat com
>>>     https://www.redhat.com/mailman/listinfo/fedora-directory-users
>>>      
>>>
>>>
>>>       
>
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3258 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20090922/bc480d11/attachment.bin>