Cron and faillog/lastlog

Kayse, Josh Joshua.Kayse at gtri.gatech.edu
Sun Feb 16 18:47:22 UTC 2014


On Feb 14, 2014, at 9:34 PM, Kayse, Josh <Joshua.Kayse at gtri.gatech.edu> wrote:

> 
> On Feb 11, 2014, at 11:17 PM, Shawn Wells <shawn at redhat.com> wrote:
> 
>> On 2/11/14, 10:49 PM, Kayse, Josh wrote:
>>> 
>>> On Feb 7, 2014, at 7:56 PM, Trevor Vaughan <tvaughan at onyxpoint.com> wrote:
>>> 
>>>> Josh,
>>>> 
>>>> I haven't seen this happening.
>>>> 
>>>> Do you happen to have a cron job that is trying to do something with sudo or su?
>>>> 
>>>> Trevor
>>>> 
>>> 
>>> Unfortunately I don’t.  Could you post your /etc/pam.d/cron file?
>>> 
>> 
>> $ cat /etc/pam.d/crond 
>> #
>> # The PAM configuration file for the cron daemon
>> #
>> #
>> # No PAM authentication called, auth modules not needed
>> account    required   pam_access.so
>> account    include    password-auth
>> session    required   pam_loginuid.so
>> session    include    password-auth
>> auth       include    password-auth
>> _______________________________________________
>> scap-security-guide mailing list
>> scap-security-guide at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
> 
> I figured out why cron stopped working for me.  If you disable the unconfined module it stops working.  So I’ll open a bugzilla for that.
> 
> 1. semodule -d unconfineduser unconfined
> 
> Actual results:
> cron stops working with the following log and AVC generated
> Feb 14 18:27:01 localhost crond[2673]: (root) FAILED to open PAM security session (Error in service module)
> Feb 14 18:27:01 (null) (null): audit(1392431221.248:729): avc: denied { read write } for pid=2673 comm=crond name=lastlog ino=666024 dev=sda2 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lastlog_t:s0 tclass=file 
> 
> Thanks for all the help.
> 
> -josh

One last comment, if I apply this patch then cron works even with unconfined disabled/removed.

--- password-auth-local	2014-02-16 13:27:46.805584897 -0500
+++ password-auth-local.cron	2014-02-15 21:03:42.100619845 -0500
@@ -24,7 +24,7 @@ password    required      pam_cracklib.s
 password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok remember=24
 password    required      pam_deny.so
 
-session     required      pam_lastlog.so showfailed
+session     optional      pam_lastlog.so showfailed
 session     optional      pam_keyinit.so revoke
 session     required      pam_limits.so
 session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid

Perhaps the SSG can be updated to utilize this line.  I believe changing required to optional is an acceptable action because it is only used for displaying failed logins.  If a user were to fail to access the lastlog file they would fail during a previous service type like auth or account.

Thanks,
-josh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140216/eb15c38a/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 1886 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20140216/eb15c38a/attachment.p7s>


More information about the scap-security-guide mailing list