Can't get Russ' pam_krb5 module to work with ssh on RHEL5
Edgecombe, Jason
jwedgeco at uncc.edu
Fri Mar 2 09:55:15 EST 2012
Hi Russ,
I got console logins, password-based ssh logins and Kerberos ssh logins to work, but I'm puzzled by the system log output. The log messages suggest that Kerberos is not detected or used, but logins are working, tickets are granted, and tokens are obtained. From a user's perspective, everything looks fine.
Should I be concerned about the logs?
Here is my system-auth-ac PAM config:
auth optional pam_group.so
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 104 quiet
auth sufficient /usr/local/lib/security/pam_krb5.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_succeed_if.so uid < 104 quiet
#account [default=bad success=ok user_unknown=ignore] /usr/local/lib/security/pam_krb5.so
account required /usr/local/lib/security/pam_krb5.so
account required pam_permit.so
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient /usr/local/lib/security/pam_krb5.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session required /usr/local/lib/security/pam_krb5.so
session required pam_afs_session.so
session required pam_mkhomedir.so skel=/etc/skel umask=0022 silent
Here is my sshd PAM config:
auth include system-auth
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session sufficient /usr/local/lib/security/pam_krb5.so
session include system-auth
session required pam_loginuid.so
Here are the logs for a password-based ssh login:
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:account): pam_sm_acct_mgmt: entry
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:account): skipping non-Kerberos login
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:account): pam_sm_acct_mgmt: exit (ignore)
Mar 2 09:49:31 myhostname sshd[32590]: Accepted password for jwedgeco from 152.15.179.130 port 50131 ssh2
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:session): pam_sm_open_session: entry
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:session): no context found, creating one
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:session): (user jwedgeco) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:session): pam_sm_open_session: exit (ignore)
Mar 2 09:49:31 myhostname sshd[32590]: pam_unix(sshd:session): session opened for user jwedgeco by (uid=0)
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:session): pam_sm_open_session: entry
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:session): no context found, creating one
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:session): (user jwedgeco) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
Mar 2 09:49:31 myhostname sshd[32590]: pam_krb5(sshd:session): pam_sm_open_session: exit (ignore)
Mar 2 09:49:31 myhostname sshd[32590]: pam_afs_session(sshd:session): pam_sm_open_session: entry (0x0)
Mar 2 09:49:31 myhostname sshd[32590]: pam_afs_session(sshd:session): running /usr/bin/aklog as UID 12345
Mar 2 09:49:31 myhostname sshd[32590]: pam_afs_session(sshd:session): pam_sm_open_session: exit (success)
Here are the logs for a kerberized ssh login:
Mar 2 09:50:18 myhostname sshd[897]: Authorized to jwedgeco, krb5 principal jwedgeco at MYREALM (krb5_kuserok)
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:account): pam_sm_acct_mgmt: entry
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:account): skipping non-Kerberos login
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:account): pam_sm_acct_mgmt: exit (ignore)
Mar 2 09:50:18 myhostname sshd[897]: Accepted gssapi-with-mic for jwedgeco from 10.17.151.248 port 33058 ssh2
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:session): pam_sm_open_session: entry
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:session): no context found, creating one
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:session): (user jwedgeco) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:session): pam_sm_open_session: exit (ignore)
Mar 2 09:50:18 myhostname sshd[897]: pam_unix(sshd:session): session opened for user jwedgeco by (uid=0)
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:session): pam_sm_open_session: entry
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:session): no context found, creating one
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:session): (user jwedgeco) unable to get PAM_KRB5CCNAME, assuming non-Kerberos login
Mar 2 09:50:18 myhostname sshd[897]: pam_krb5(sshd:session): pam_sm_open_session: exit (ignore)
Mar 2 09:50:18 myhostname sshd[897]: pam_afs_session(sshd:session): pam_sm_open_session: entry (0x0)
Mar 2 09:50:18 myhostname sshd[897]: pam_afs_session(sshd:session): running /usr/bin/aklog as UID 12345
Mar 2 09:50:18 myhostname sshd[897]: pam_afs_session(sshd:session): pam_sm_open_session: exit (success)
For completeness, here are the logs for a console login:
Mar 2 09:51:02 myhostname login: pam_unix(login:auth): authentication failure; logname= uid=0 euid=0 tty=tty1 ruser= rhost= user=jwedgeco
Mar 2 09:51:02 myhostname login: pam_krb5(login:auth): pam_sm_authenticate: entry
Mar 2 09:51:02 myhostname login: pam_krb5(login:auth): (user jwedgeco) attempting authentication as jwedgeco at MYREALM
Mar 2 09:51:02 myhostname login: pam_krb5(login:auth): user jwedgeco authenticated as jwedgeco at MYREALM
Mar 2 09:51:02 myhostname login: pam_krb5(login:auth): pam_sm_authenticate: exit (success)
Mar 2 09:51:02 myhostname login: pam_krb5(login:account): pam_sm_acct_mgmt: entry
Mar 2 09:51:02 myhostname login: pam_krb5(login:account): (user jwedgeco) retrieving principal from cache
Mar 2 09:51:02 myhostname login: pam_krb5(login:account): pam_sm_acct_mgmt: exit (success)
Mar 2 09:51:02 myhostname login: pam_unix(login:session): session opened for user jwedgeco by (uid=0)
Mar 2 09:51:02 myhostname login: pam_krb5(login:session): pam_sm_open_session: entry
Mar 2 09:51:02 myhostname login: pam_krb5(login:session): (user jwedgeco) initializing ticket cache /tmp/krb5cc_12345_4QvONg
Mar 2 09:51:02 myhostname login: pam_krb5(login:session): pam_sm_open_session: exit (success)
Mar 2 09:51:02 myhostname login: pam_afs_session(login:session): pam_sm_open_session: entry (0x0)
Mar 2 09:51:02 myhostname login: pam_afs_session(login:session): running /usr/bin/aklog as UID 12345
Mar 2 09:51:02 myhostname login: pam_afs_session(login:session): pam_sm_open_session: exit (success)
Mar 2 09:51:02 myhostname login: pam_krb5(login:setcred): pam_sm_setcred: entry (establish)
Mar 2 09:51:02 myhostname login: pam_krb5(login:setcred): pam_sm_setcred: exit (success)
Mar 2 09:51:02 myhostname login: LOGIN ON tty1 BY jwedgeco
Thanks,
Jason
---------------------------------------------------------------------------
Jason Edgecombe | Linux and Solaris Administrator
UNC Charlotte | The William States Lee College of Engineering
9201 University City Blvd. | Charlotte, NC 28223-0001
Phone: 704-687-3514
jwedgeco at MYREALM | http://coe.MYREALM | Facebook
---------------------------------------------------------------------------
If you are not the intended recipient of this transmission or a person responsible for delivering it to the intended recipient, any disclosure, copying, distribution, or other use of any of the information in this transmission is strictly prohibited. If you have received this transmission in error, please notify me immediately by reply e-mail or by telephone at 704-687-3514. Thank you.
-----Original Message-----
From: kerberos-bounces at mit.edu [mailto:kerberos-bounces at mit.edu] On Behalf Of Russ Allbery
Sent: Thursday, March 01, 2012 8:40 PM
To: Jason Edgecombe
Cc: kerberos at mit.edu
Subject: Re: Can't get Russ' pam_krb5 module to work with ssh on RHEL5
Jason Edgecombe <jason at rampaginggeek.com> writes:
> On 03/01/2012 07:38 PM, Russ Allbery wrote:
>> If you lock users in /etc/shadow, pam_unix will reject all logins via
>> whatever mechanism for those users. So you either have to arrange to
>> bypass pam_unix entirely in PAM, or you need to not lock users and
>> instead just give them invalid password entries.
>> However, "*" isn't locking the account; "!" is locking the account. At
>> least on Debian; maybe pam_unix works differently on Red Hat?
> Well, pam_unix worked fine with RedHat's pam_krb5. Console and GDM
> logins work; only ssh is broken. I don't think that the password entries
> is a problem.
There are two things that are obviously failing given your logs:
* pam-krb5 is not running at all during the authentication step. This
obviously can't be a problem with pam-krb5. :) Something is wrong with
the PAM configuration.
* The account group in PAM is rejecting the login despite the fact that
pam-krb5 is returning ignore. I'm pretty sure that adding the missing
ignore=ignore directive will fix this.
--
Russ Allbery (rra at stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos at mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
More information about the Kerberos
mailing list