<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Feb 14, 2014, at 9:34 PM, Kayse, Josh <<a href="mailto:Joshua.Kayse@gtri.gatech.edu">Joshua.Kayse@gtri.gatech.edu</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Feb 11, 2014, at 11:17 PM, Shawn Wells <<a href="mailto:shawn@redhat.com">shawn@redhat.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<div bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 2/11/14, 10:49 PM, Kayse, Josh
wrote:<br>
</div>
<blockquote cite="mid:23630C3E-2BE4-47C3-A9D8-9187E3F235C3@gtri.gatech.edu" type="cite"><br>
<div>
<div>On Feb 7, 2014, at 7:56 PM, Trevor Vaughan <<a moz-do-not-send="true" href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a>>
wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div dir="ltr">Josh,
<div><br>
</div>
<div>I haven't seen this happening.</div>
<div><br>
</div>
<div>Do you happen to have a cron job that is trying to do
something with sudo or su?</div>
<div><br>
</div>
<div>Trevor</div>
</div>
<div class="gmail_extra"><br>
</div>
</blockquote>
<div><br>
</div>
Unfortunately I don’t. Could you post your /etc/pam.d/cron
file?</div>
<div><br>
</div>
</blockquote>
<br>
$ cat /etc/pam.d/crond <br>
#<br>
# The PAM configuration file for the cron daemon<br>
#<br>
#<br>
# No PAM authentication called, auth modules not needed<br>
account required pam_access.so<br>
account include password-auth<br>
session required pam_loginuid.so<br>
session include password-auth<br>
auth include password-auth<br>
</div>
_______________________________________________<br>scap-security-guide mailing list<br><a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br><a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br></blockquote></div><br><div>I figured out why cron stopped working for me. If you disable the unconfined module it stops working. So I’ll open a bugzilla for that.</div><div><br></div><div>1. semodule -d unconfineduser unconfined</div><div><br></div><div>Actual results:</div><div>cron stops working with the following log and AVC generated</div><div>Feb 14 18:27:01 localhost crond[2673]: (root) FAILED to open PAM security session (Error in service module)</div><div>Feb 14 18:27:01 (null) (null): audit(1392431221.248:729): avc: denied { read write } for pid=2673 comm=crond name=lastlog ino=666024 dev=sda2 scontext=system_u:system_r:crond_t:s0-s0:c0.c1023 tcontext=system_u:object_r:lastlog_t:s0 tclass=file </div><div><br></div><div>Thanks for all the help.</div><div><br></div><div>-josh</div></div></blockquote><br></div><div>One last comment, if I apply this patch then cron works even with unconfined disabled/removed.</div><div><br></div><div><div>--- password-auth-local<span class="Apple-tab-span" style="white-space:pre">        </span>2014-02-16 13:27:46.805584897 -0500</div><div>+++ password-auth-local.cron<span class="Apple-tab-span" style="white-space:pre">        </span>2014-02-15 21:03:42.100619845 -0500</div><div>@@ -24,7 +24,7 @@ password required pam_cracklib.s</div><div> password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok remember=24</div><div> password required pam_deny.so</div><div> </div><div>-session required pam_lastlog.so showfailed</div><div>+session optional pam_lastlog.so showfailed</div><div> session optional pam_keyinit.so revoke</div><div> session required pam_limits.so</div><div> session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid</div><div><br></div></div>Perhaps the SSG can be updated to utilize this line. I believe changing required to optional is an acceptable action because it is only used for displaying failed logins. If a user were to fail to access the lastlog file they would fail during a previous service type like auth or account.<div><br></div><div>Thanks,</div><div>-josh</div></body></html>