pam_mkhomedir 777 on parent directory

[Darren Tucker]

Thorsten Kukuk wrote:
> On Wed, Oct 13, Joey Trungale wrote:
>>I have sshd using pam_mkhomedir to create home directories as users are
>>authenticated with pam_winbind.  The home directory setup
>>is /home/NT_DOMAIN/username. The only problem with this is that
>>NT_DOMAIN must be 777 in order for pam to be able to create the users
>>directory in it.  I'm guessing this is because pam drops privs before it
>>gets to this point...maybe it's run as the user. [...]

> Has nothing to do with PAM, is a typical sshd problem.

Correction: it *was* a typical (OpenSSH) sshd problem.  Recent versions 
(>3.7x) will run pam_session and pam_setcred as root even with 
UsePrivilegeSeparation=yes.

We've been working to improve the PAM support in OpenSSH.  If you've got 
a module that doesn't work with (the current version of) OpenSSH, please 
report it.  I don't guarantee it will be made to work, but I do promise 
to look at it.

OpenSSH's PAM support will never be perfect (because of the mismatches 
between the SSH protocol and the PAM API, and because it's harder to do 
PAM in a privilege separated environment like OpenSSH) but it can be 
improved.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.