Comments (4)
Comment #1 originally posted by jaqx0r on 2014-09-16T10:09:00.000Z:
Hello
Did you cache the shadow and could be authenticated normally on pam ?
from nsscache.
Comment #2 originally posted by jaqx0r on 2014-09-16T11:36:47.000Z:
I've tried with pamtester and it doesn't work either:
baca@PC2101 ~ $ ls -l /etc/shadow.cache*
-rw-r----- 1 root root 125392 sep 15 21:02 /etc/shadow.cache
-rw-r----- 1 root root 27869 sep 15 21:02 /etc/shadow.cache.ixname
baca@PC2101 ~ $ pamtester login baca authenticate
Password:
pamtester: Authentication failure
Relevant lines in auth.log:
PC2101 ~ # tail -3 /var/log/auth.log
Sep 16 13:23:53 PC2101 unix_chkpwd[13229]: check pass; user unknown
Sep 16 13:23:53 PC2101 unix_chkpwd[13229]: password check failed for user (baca)
Sep 16 13:23:53 PC2101 pamtester: pam_unix(login:auth): authentication failure; logname=baca uid=10714 euid=10714 tty= ruser= rhost= user=baca
After 'chgrp shadow /etc/shadow.cache*' authentication works normally:
baca@PC2101 ~ $ ls -l /etc/shadow.cache*
-rw-r----- 1 root shadow 125392 sep 15 21:02 /etc/shadow.cache
-rw-r----- 1 root shadow 27869 sep 15 21:02 /etc/shadow.cache.ixname
baca@PC2101 ~ $ pamtester login baca authenticate
Password:
pamtester: successfully authenticated
Note that if I run pamtester as root, it works regardless of the cache files' ownership:
PC2101 ~ # ls -l /etc/shadow.cache*
-rw-r----- 1 root root 125392 sep 15 21:02 /etc/shadow.cache
-rw-r----- 1 root root 27869 sep 15 21:02 /etc/shadow.cache.ixname
PC2101 ~ # pamtester login baca authenticate
Password:
pamtester: successfully authenticated
PC2101 ~ #
But this is not the case with xscreensaver, which runs as the logged in user.
from nsscache.
Comment #3 originally posted by jaqx0r on 2014-09-16T12:15:43.000Z:
Just a piece more of info, it looks like the ultimate reason why /etc/shadow* must be chgrp'ed shadow is because /sbin/unix_chkpwd (used by pam_unix) is setgid shadow:
PC2101 ~ # ls -l /sbin/unix_chkpwd
-rwxr-sr-x 1 root shadow 30432 ene 31 2014 /sbin/unix_chkpwd
from nsscache.
Comment #4 originally posted by jaqx0r on 2014-10-20T05:00:09.000Z:
Applied in github master.
from nsscache.
Related Issues (20)
- nsscache doesn't map all members of a group HOT 2
- reformat by removing error E713 for membership test HOT 7
- ShadowExpire == -1 HOT 1
- sshkey map fails to import HOT 4
- Not all LDAP servers provide LastModification Dates
- bsddb3 is deprecated HOT 3
- `uidattr` ignored when writing out groups
- mox3 archived & deprecated upstream, please update tests to not use it HOT 3
- Does not work offline. HOT 6
- Question: Merge groups with the same ids
- Add support for GCS source HOT 1
- skip the unexcepted line in the cache file
- Please support nested groups HOT 11
- Tagging of versions HOT 3
- nsscache doesn't update group cache from ldap source HOT 7
- ConfigParser.NoSectionError: No section: 'suffix' with nsscache >= 0.36 HOT 2
- configure nsscache with samba4 active directory HOT 31
- is nsscache python3 compatible? HOT 25
- Get integration tests running in CI HOT 37
- Properly define byte vs string types in source and cache api boundaries
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nsscache.