[SSSD] pam / sssd / cronjobs

Pavel Březina pbrezina at redhat.com
Thu Oct 25 08:54:57 UTC 2012


On 10/23/2012 03:04 PM, Olivier wrote:
> Hello everyone,
>
> I have deployed sssd to authentify users when they log in my servers,
> that works well : thanks!
>
> However, since then user's cron jobs don't execute anymore.
>
> I suspect that this is a pam issue :
>
> # tail -f /var/log/cron
> ...
> Oct 23 14:35:01 boxmax crond[30085]: Autorisation refused
> Oct 23 14:35:01 boxmax crond[30085]: CRON (john) ERROR: failed to open
> PAM security session: Mauvais descripteur de fichier
> Oct 23 14:35:01 boxmax crond[30085]: CRON (john) ERROR: cannot set
> security context
>
> Here is the "boxmax" configuration :
>
> # cat /etc/issue
> Red Hat Enterprise Linux Server release 5.5 (Tikanga)
>
> # cat /etc/pam.d/crond
>
> #
> # The PAM configuration file for the cron daemon
> #
> #
> auth	   sufficient pam_env.so
> auth       required   pam_rootok.so
> auth       include    system-auth
> account    required   pam_access.so
> account    include    system-auth
> session    required   pam_loginuid.so
> session    include    system-auth
>
> Here is an extract of my access.conf
>
> # cat /etc/security/access.conf :
>
> ...
> +:network:ALL
>
> -:ALL:ALL
>
> John is member of ldap posixgroup "network".
>
> I know that this access rule and john's group are correctly set up
> since if I remove this rule : "+:reseau:ALL" then john can't login
> anymore (he properly does if I add the rule).
>
> I also have tested with the new syntax in access.conf with no success:
>
> +:(reseau):ALL
> -:ALL:ALL
>
> but it doesn't work neither.
>
> If I try to add this line in access.conf :
>
> +:john:ALL
> -:ALL:ALL
>
> Then it works : john's cron jobs are executed.
>
> It sounds like pam.d/crond doesn't get the users groups ?
>
> Could anyone help ?
>
> Thanks;
>
>
> For information, here is what my pam.d/ sshd system-auth looks like :
>
> # cat /etc/pam.d/sshd
> #%PAM-1.0
> auth       include      system-auth
> account    required     pam_nologin.so
> account    include      system-auth
> password   include      system-auth
> session    optional     pam_keyinit.so force revoke
> session    include      system-auth
> session    required     pam_loginuid.so
>
> # cat /etc/pam.d/system-auth
> #%PAM-1.0
> # This file is auto-generated.
> # User changes will be destroyed the next time authconfig is run.
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        sufficient    pam_sss.so use_first_pass
> auth        sufficient    pam_ldap.so use_first_pass
> auth        required      pam_deny.so
>
> account     required      pam_access.so
> account     required      pam_unix.so broken_shadow
> account     sufficient    pam_localuser.so
> account     sufficient    pam_succeed_if.so uid < 500 quiet
> account     [default=bad success=ok user_unknown=ignore] pam_sss.so
> account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
> account     required      pam_permit.so
>
> password    requisite     pam_cracklib.so try_first_pass retry=3
> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
> use_authtok
> password    sufficient    pam_sss.so use_authtok
> password    sufficient    pam_ldap.so use_authtok
> password    required      pam_deny.so
>
> session     optional      pam_keyinit.so revoke
> session     required      pam_limits.so
> session     optional      pam_mkhomedir.so
> session     [success=1 default=ignore] pam_succeed_if.so service in
> crond quiet use_uid
> session     required      pam_unix.so
> session     optional      pam_sss.so
> session     optional      pam_ldap.so

Hi,
the pam configuration looks good to me.

Does the user have a password set?

What does /var/log/secure, /var/log/audit/audit.log and 
/var/log/messages says?

Thanks,
Pavel.





More information about the sssd-devel mailing list