[SSSD] pam / sssd / cronjobs

Olivier ldap at guillard.nom.fr
Tue Oct 23 13:04:41 UTC 2012


Hello everyone,

I have deployed sssd to authentify users when they log in my servers,
that works well : thanks!

However, since then user's cron jobs don't execute anymore.

I suspect that this is a pam issue :

# tail -f /var/log/cron
...
Oct 23 14:35:01 boxmax crond[30085]: Autorisation refused
Oct 23 14:35:01 boxmax crond[30085]: CRON (john) ERROR: failed to open
PAM security session: Mauvais descripteur de fichier
Oct 23 14:35:01 boxmax crond[30085]: CRON (john) ERROR: cannot set
security context

Here is the "boxmax" configuration :

# cat /etc/issue
Red Hat Enterprise Linux Server release 5.5 (Tikanga)

# cat /etc/pam.d/crond

#
# The PAM configuration file for the cron daemon
#
#
auth	   sufficient pam_env.so
auth       required   pam_rootok.so
auth       include    system-auth
account    required   pam_access.so
account    include    system-auth
session    required   pam_loginuid.so
session    include    system-auth

Here is an extract of my access.conf

# cat /etc/security/access.conf :

...
+:network:ALL

-:ALL:ALL

John is member of ldap posixgroup "network".

I know that this access rule and john's group are correctly set up
since if I remove this rule : "+:reseau:ALL" then john can't login
anymore (he properly does if I add the rule).

I also have tested with the new syntax in access.conf with no success:

+:(reseau):ALL
-:ALL:ALL

but it doesn't work neither.

If I try to add this line in access.conf :

+:john:ALL
-:ALL:ALL

Then it works : john's cron jobs are executed.

It sounds like pam.d/crond doesn't get the users groups ?

Could anyone help ?

Thanks;


For information, here is what my pam.d/ sshd system-auth looks like :

# cat /etc/pam.d/sshd
#%PAM-1.0
auth       include      system-auth
account    required     pam_nologin.so
account    include      system-auth
password   include      system-auth
session    optional     pam_keyinit.so force revoke
session    include      system-auth
session    required     pam_loginuid.so

# cat /etc/pam.d/system-auth
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     required      pam_access.so
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password    sufficient    pam_sss.so use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_mkhomedir.so
session     [success=1 default=ignore] pam_succeed_if.so service in
crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so
session     optional      pam_ldap.so



More information about the sssd-devel mailing list