capath does not work when linked with gnutls, enable cainfo from yubico-c-client about yubico-pam

[klali]

Would you mind submitting this as a pull request to make merging (and attribution) easier?

/klas

[Mrten]

That's a hurdle for me, I don't know git :)

[klali]

commited as 9a132bc

unfortunately referenced the wrong issue..

[Mrten]

Thanks!

[lawrencejones]

@Mrten did you find this fixed your problem? We're having similar issues where a ykclient linked against gnutls curl is unable to validate our certificate, and using cainfo=/etc/ssl/certs/ca-certificates.crt isn't doing anything to help.

Did you happen to figure out what was actually happening to cause this problem? It's very frustrating for us, and we're having to a reverse proxy locally to sidestep the SSL issue.

[Mrten]

Yes, it did fix my problem. As part of my debugging -two years ago already!- I asked that curl_verbose was enabled when you set a 'debug' flag on pam_yubico which yubico graciously agreed to, have you tried that already? Should be logging in syslog.

This is the first part of my current /etc/pam.d/su:

# This allows root to su without passwords (normal operation)
auth       sufficient pam_rootok.so

# skip yubikey als we naar niet-root su doen
auth    [default=4 success=ignore]  pam_succeed_if.so uid eq 0

auth optional  pam_echo.so file=/etc/yubikey.login

# en daarna yubikey, voor capath heb je libcurl-gelinkt-met-openssl nodig!!
auth    [default=1 success=ignore]  pam_yubico.so id=1 key=[base64 key] urllist=https://[local yubikey host]/wsapi/2.0/verify authfile=[map] cainfo=[absolute-path-to-certificate]

# vraag om pin, use_uid moet maar is eigen uitbreiding
auth    [success=3 default=ignore]  pam_userdb.so db=/etc/yubikey.pin crypt=crypt use_first_pass use_uid

auth optional  pam_echo.so file=/etc/yubikey.failed.login

# here are the per-package modules (the "Primary" block)
auth    [success=1 default=ignore]  pam_unix.so

# here's the fallback if no module succeeds
auth    requisite                   pam_deny.so

# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                    pam_permit.so

# na permit gaat niks meer door dus als er extra eisen zijn aan su dan moeten die boven deze regels
# kijk uit met invoegen, default=XX en success=XX betekenen "jumps"

The certificate is a single certificate for the wsapi webserver in PEM format, the mapfile lists all yubikeys that are allowed to su to root.

This PAM file asks for a PIN + yubikey first, if that fails it asks for the normal root password. The PIN is to make a lost yubikey less dramatic.

I'm on Ubuntu 14.04, which links pam_yubico with gnutls:

root@somewhere:/ ldd /lib/security/pam_yubico.so
	libyubikey.so.0 => /usr/lib/libyubikey.so.0 (0x00007f0d6cd73000)
	libykpers-1.so.1 => /usr/lib/libykpers-1.so.1 (0x00007f0d6cb61000)
	libcurl-gnutls.so.4 => /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4 (0x00007f0d6c328000)
        ...

You should really try the debug flag to see if this is the problem because I can't seem to find that gnutls is still having this problem on haxx.se.