LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Desktop
User Name
Password
Linux - Desktop This forum is for the discussion of all Linux Software used in a desktop context.

Notices

Reply
 
Search this Thread
Old 09-26-2012, 03:58 PM   #1
scott.anderson
Member
 
Registered: Mar 2005
Location: Natick, MA
Distribution: Redhat EL 5.2, Fedora 8
Posts: 30

Rep: Reputation: 15
Can ssh to LDAP client workstation running CentOS 6.3 but cannot "su" on workstation


I have an LDAP server (RHEL 6.3) and about two dozen "client" workstations. Most are running CentOS 6.3, but some older ones are running Fedora 14.

I can ssh into the CentOS workstations but once I'm there, I can't "su" to another user. On the Fedora 14 machines, I can do both.

Since both things work on the Fedora 14 machines, I'm assuming that the fault is not with the RHEL server, the network, the firewalls or anything like that. I was looking specifically at PAM.

I spent a lot of time digging around here, since I felt like, with a running machine, I should be able to determine the differences and fix them, but I ultimately failed. I've written a blog entry about the whole investigation here:
https://blogs.wellesley.edu/cssysadm...entos-clients/

The very short version is something like this:

On the Fedora machine:
/etc/pam.d/su uses /etc/pam.d/system-auth which uses pam_ldap.so
/etc/pam.d/sshd uses /etc/pam.d/password-auth which uses pam_ldap.so
/etc/nsswitch.conf has passwd: files sss
/etc/openldap/ldap.conf is configured and ldapsearch works
/etc/sssd/sssd.conf is configured

On the CentOS machine:
/etc/pam.d/su uses /etc/pam.d/system-auth which uses pam_sss.so
/etc/pam.d/sshd uses /etc/pam.d/password-auth which uses pam_ldap.so
/etc/nsswitch.conf has passwd: files sss
/etc/openldap/ldap.conf is configured and ldapsearch works
/etc/sssd/sssd.conf is configured

I dumped all the configuration information using authconfig --savebackup on both machines and did a "diff -r" on those directories. The only seemingly-important difference I could find was in pam_sss.so versus pam_ldap.so. Whatever used pam_sss fails.

Strangely, when I did

authconfig --enableldapauth --update

the password-auth changed to pam_sss and so sshd failed as well as su.

All the details, probably more than you want, are in the blog above. This really seems like it should be easily solved, but I can't seem to do it, short of hand-editing files in /etc/pam.d/ and I believe that's supposed to be a no-no.

If I do a (successful) ssh on the CentOS machine, and an (unsuccessful) su on it, here are the /var/log/secure entries:

Sep 26 15:55:23 gibbon sshd[3254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=gibbon.wellesley.edu user=anderson
Sep 26 15:55:23 gibbon sshd[3254]: Accepted password for anderson from 149.130.136.34 port 60351 ssh2
Sep 26 15:55:23 gibbon sshd[3254]: pam_unix(sshd:session): session opened for user anderson by (uid=0)
Sep 26 15:55:31 gibbon su: pam_unix(su-l:auth): authentication failure; logname=anderson uid=716 euid=0 tty=pts/1 ruser=anderson rhost= user=anderson
Sep 26 15:55:32 gibbon su: pam_sss(su-l:auth): authentication failure; logname=anderson uid=716 euid=0 tty=pts/1 ruser=anderson rhost= user=anderson
Sep 26 15:55:32 gibbon su: pam_sss(su-l:auth): received for user anderson: 4 (System error)
Sep 26 15:55:35 gibbon sshd[3256]: Received disconnect from 149.130.136.34: 11: disconnected by user
Sep 26 15:55:35 gibbon sshd[3254]: pam_unix(sshd:session): session closed for user anderson
[root@gibbon pam.d]


Any help or hints?

Thanks!
 
Old 09-26-2012, 07:20 PM   #2
btncix
Member
 
Registered: Aug 2009
Location: NC, USA
Distribution: Slackware x86
Posts: 141

Rep: Reputation: 26
shooting in the dark here, but does su work when you are logged directly to the host instead of through ssh?
 
Old 09-27-2012, 05:41 PM   #3
scott.anderson
Member
 
Registered: Mar 2005
Location: Natick, MA
Distribution: Redhat EL 5.2, Fedora 8
Posts: 30

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by btncix View Post
shooting in the dark here, but does su work when you are logged directly to the host instead of through ssh?
Interesting thought. I got to the console today to check, and su does not work then, either. Thanks for the idea. -- Scott
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
seeking linux workstation oriented "audit" or "inventory" utility SaintDanBert Linux - Software 2 02-08-2012 06:02 AM
trouble running "kontact" on GNOME workstation SaintDanBert Linux - Desktop 2 09-05-2011 01:13 PM
Windows workstation Samba error "not allowed to log on from this workstation" salscozzari Linux - Networking 0 01-02-2008 03:04 PM
Samba Fileserver, XP Pro Client, "Cannot Login From This Workstation"? rsmith Linux - Networking 1 09-16-2005 03:59 AM
Virtual PC 2004 and VWware Workstation - "interface eth0 [failed]" abijahboaz Linux - Newbie 8 10-16-2004 08:53 PM


All times are GMT -5. The time now is 03:57 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration