sds at tycho.nsa.gov
Fri Jun 5 15:12:50 UTC 2009
On Fri, 2009-06-05 at 11:09 -0400, Stephen Smalley wrote:
> On Fri, 2009-06-05 at 08:09 -0700, Vadym Chepkov wrote:
> > --- On Fri, 6/5/09, Stephen Smalley <sds at tycho.nsa.gov> wrote:
> > > Found this thread:
> > > http://firstname.lastname@example.org/msg15640.html
> > >
> > > Can you configure winbind with use default domain=yes?
> > >
> > I do have have such setup. Both type of users are affected: local and "winbind"
> Can you append "debug" to the arguments to the latter instance of
> pam_selinux.so, e.g.:
> session required pam_selinux.so open env_params debug
> And then login again via ssh and look in /var/log/secure?
Hmmm...btw, I notice that order of entries has changed in /etc/pam.d in
F11 from F10, with the:
session include system-auth
line at the end of /etc/pam.d/sshd rather than between the two
So maybe the problem is that when you upgraded, it didn't replace your
pam config due to your local configuration of winbind, and thus you
didn't get that ordering change.
I know that they reworked the way sshd interacts with pam_selinux.
National Security Agency
More information about the fedora-selinux-list