[SSSD] Problem with authentication via KDE

Stephen Gallagher sgallagh at redhat.com
Fri Jan 28 13:43:18 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 01/28/2011 08:17 AM, Andy Kannberg wrote:
> Stephen,
> 
> I've tried to rearrange the system-auth. However, when offline, I still
> cannot login with KDE.
> the system-auth looks like this:
> 
> #%PAM-1.0
> # This file is auto-generated.
> # User changes will be destroyed the next time authconfig is run.
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so likeauth nullok
> account     sufficient    pam_succeed_if.so uid > 500 quiet

This line definitely looks out of place here. This should probably be
"auth" not "account, and it's recommended that it be "requisite" instead
of "sufficient". Also, you probably want >= 500 rather than > 500

> auth        sufficient    pam_sss.so use_first_pass
> auth        required      pam_deny.so
> 
> account     sufficient    pam_localuser.so
> account     required      pam_unix.so broken_shadow
You probably want to reverse pam_unix and pam_localuser here

> account     sufficient    pam_succeed_if.so uid > 500 quiet
This is backwards. You want system services (<500) to be sufficient
here, not all users > 500.

> account     [default=bad success=ok user_unknown=ignore] pam_sss.so
> account     required      pam_permit.so
> #account     required      pam_access.so
> accessfile=/etc/security/access.netgroup.conf
> 
> password    requisite     pam_cracklib.so try_first_pass retry=3
> password    sufficient    pam_unix.so nullok use_authtok md5 shadow
> password    sufficient    pam_sss.so use_authtok
> password    required      pam_deny.so
> 
> #session     required      pam_limits.so
> session     required      pam_unix.so
> session      required      pam_keyinit.so revoke
> session     optional      pam_sss.so


Give that a try.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1Cx/YACgkQeiVVYja6o6OUUwCfbFWBEInxSt/UHQfagKs5Iwyb
wGEAoJ8/txMCI/fBNliHxhgdoJxFp7OD
=2kN+
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list