PAM broken

Balderayne · 10-14-2005, 11:52 PM

Hello all...

I have a problem. PAM was evidentally installed and in use on one of our Enterprise 3 ES servers and we didn't realize it. At some point when changes were made to "passwd" and some programs were re0installed -- those apps stopped working properly even though their "pam" files were intact.

I am not at all certain that we even NEEd PAM on this server. I there a clean way to remove it without blowing-up the whole server?

Thanks...

David

unSpawn · 10-15-2005, 06:52 AM

At some point when changes were made to "passwd" and some programs were re0installed -- those apps stopped working properly even though their "pam" files were intact.
Could you elaborate on what passwd changes where made and what apps where reinstalled and/or stopped working? Was PAM upgradedas well? What "evidence" do you have the problem lies with PAM? Did you try using the debug flag in the pam service files? Anything in the system logs?

I am not at all certain that we even NEEd PAM on this server.
Yes you do, it's just nobody told you so.

I there a clean way to remove it without blowing-up the whole server?
In my best HAL voice: Don't do that Dave...

Balderayne · 10-15-2005, 12:55 PM

unSpawn... thanks...

Well... here's the deal.

We had some user issues with Samba and when we were looking through the "passwd" file we noticed that the user primary and secondary group number were skewed i.e.:

User1 123:456
User2 456:789
User3 789:012
and so on... which it had not been and one of my guys decided to fix everything to match the "group" file. Well... all HELL broke loose and we started having problems with our email system, Citadel (www.citadel.org).

Prior to this issue, we had been getting odd responses from PAM in the messages log and so, by searching the kernel.org site found the idea to create/modify "other" in "pam.d" to look like this:

Code:

#%PAM-1.0
#auth     required       /lib/security/$ISA/pam_deny.so
#account  required       /lib/security/$ISA/pam_deny.so
#password required       /lib/security/$ISA/pam_deny.so
#session  required       /lib/security/$ISA/pam_deny.so

auth     required       pam_unix.so
account  required       pam_unix.so
password required       pam_unix.so
session  required       pam_unix.so

which had corrected for issues of users not being able to access mail.

We have now, multiple times, blown away and re-installed CITADEL and cannot get it to link up with the user profiles. I am kind of assuming, possibly dangerously, that the problem lies with our mods to the "passwd" file and PAM. The latter as it had been a bit of an issue previously. Needless to say, I know very little about PAM and it is confusing the Hell out of me now that I am in this other mess. I have a few books that touch on it but they leave a bit to be desired. I have, in the mean time, re-configured sendmail and imap to handle mail while I figure out the rest of this disaster.

Does this make any more sense? I am a bit frazzled by this to say the very least.

David - Leaving Pad Bay doors closed for now.

unSpawn · 10-16-2005, 06:00 AM

we noticed that the user primary and secondary group number were skewed
What's the scope of the skewage? All users, all wetware users or just a few? Can you trace it back in the logs? Can you link that to actions on the system like passwd changes or sw upgrades?

Prior to this issue, we had been getting odd responses from PAM in the messages log
Could you elaborate on that? I mean PAM could be defined as being "just" an intermediate between autentication databases and applications and therefore *couldn't* fsck things up like that on it's own.

one of my guys decided to fix everything
I would be interested to know how he "fixed" it.

Noth · 10-16-2005, 05:40 PM

Quote:

I am not at all certain that we even NEEd PAM on this server. I there a clean way to remove it without blowing-up the whole server?

AFAIK PAM is the authentication backend for virtually every base package in nearly every Linux distribution. Removing PAM would not only break things, it would set you back to like the year 1992 functionality-wise =)

msantinho · 10-16-2005, 07:20 PM

Quote:

AFAIK PAM is the authentication backend for virtually every base package in nearly every Linux distribution. Removing PAM would not only break things, it would set you back to like the year 1992 functionality-wise =)

You forgot to mention that Slackware does not support PAM out of the box.

Noth · 10-16-2005, 07:39 PM

Quote:

You forgot to mention that Slackware does not support PAM out of the box.

I believe that was covered by my the "nearly every Linux distribution" part of my comment.

Slackware is the odd man out on a lot of fronts, not just with regards to PAM, just because Pat is trying to emulate a BSD environment with a Linux kernel for some unknown reason. And IMO he's an idiot for not using PAM.