[SSSD] pam / sssd / cronjobs

Olivier ldap at guillard.nom.fr
Thu Oct 25 09:59:48 UTC 2012


Thanks Pavel,

I opened a redhat ticket that includes couple of additional information,
see here :

https://bugzilla.redhat.com/show_bug.cgi?id=869574

The problem appears under redhat5.

---
Olivier


2012/10/25 Pavel Březina <pbrezina at redhat.com>:
> On 10/23/2012 03:04 PM, Olivier wrote:
>>
>> Hello everyone,
>>
>> I have deployed sssd to authentify users when they log in my servers,
>> that works well : thanks!
>>
>> However, since then user's cron jobs don't execute anymore.
>>
>> I suspect that this is a pam issue :
>>
>> # tail -f /var/log/cron
>> ...
>> Oct 23 14:35:01 boxmax crond[30085]: Autorisation refused
>> Oct 23 14:35:01 boxmax crond[30085]: CRON (john) ERROR: failed to open
>> PAM security session: Mauvais descripteur de fichier
>> Oct 23 14:35:01 boxmax crond[30085]: CRON (john) ERROR: cannot set
>> security context
>>
>> Here is the "boxmax" configuration :
>>
>> # cat /etc/issue
>> Red Hat Enterprise Linux Server release 5.5 (Tikanga)
>>
>> # cat /etc/pam.d/crond
>>
>> #
>> # The PAM configuration file for the cron daemon
>> #
>> #
>> auth       sufficient pam_env.so
>> auth       required   pam_rootok.so
>> auth       include    system-auth
>> account    required   pam_access.so
>> account    include    system-auth
>> session    required   pam_loginuid.so
>> session    include    system-auth
>>
>> Here is an extract of my access.conf
>>
>> # cat /etc/security/access.conf :
>>
>> ...
>> +:network:ALL
>>
>> -:ALL:ALL
>>
>> John is member of ldap posixgroup "network".
>>
>> I know that this access rule and john's group are correctly set up
>> since if I remove this rule : "+:reseau:ALL" then john can't login
>> anymore (he properly does if I add the rule).
>>
>> I also have tested with the new syntax in access.conf with no success:
>>
>> +:(reseau):ALL
>> -:ALL:ALL
>>
>> but it doesn't work neither.
>>
>> If I try to add this line in access.conf :
>>
>> +:john:ALL
>> -:ALL:ALL
>>
>> Then it works : john's cron jobs are executed.
>>
>> It sounds like pam.d/crond doesn't get the users groups ?
>>
>> Could anyone help ?
>>
>> Thanks;
>>
>>
>> For information, here is what my pam.d/ sshd system-auth looks like :
>>
>> # cat /etc/pam.d/sshd
>> #%PAM-1.0
>> auth       include      system-auth
>> account    required     pam_nologin.so
>> account    include      system-auth
>> password   include      system-auth
>> session    optional     pam_keyinit.so force revoke
>> session    include      system-auth
>> session    required     pam_loginuid.so
>>
>> # cat /etc/pam.d/system-auth
>> #%PAM-1.0
>> # This file is auto-generated.
>> # User changes will be destroyed the next time authconfig is run.
>> auth        required      pam_env.so
>> auth        sufficient    pam_unix.so try_first_pass
>> auth        requisite     pam_succeed_if.so uid >= 500 quiet
>> auth        sufficient    pam_sss.so use_first_pass
>> auth        sufficient    pam_ldap.so use_first_pass
>> auth        required      pam_deny.so
>>
>> account     required      pam_access.so
>> account     required      pam_unix.so broken_shadow
>> account     sufficient    pam_localuser.so
>> account     sufficient    pam_succeed_if.so uid < 500 quiet
>> account     [default=bad success=ok user_unknown=ignore] pam_sss.so
>> account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
>> account     required      pam_permit.so
>>
>> password    requisite     pam_cracklib.so try_first_pass retry=3
>> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
>> use_authtok
>> password    sufficient    pam_sss.so use_authtok
>> password    sufficient    pam_ldap.so use_authtok
>> password    required      pam_deny.so
>>
>> session     optional      pam_keyinit.so revoke
>> session     required      pam_limits.so
>> session     optional      pam_mkhomedir.so
>> session     [success=1 default=ignore] pam_succeed_if.so service in
>> crond quiet use_uid
>> session     required      pam_unix.so
>> session     optional      pam_sss.so
>> session     optional      pam_ldap.so
>
>
> Hi,
> the pam configuration looks good to me.
>
> Does the user have a password set?
>
> What does /var/log/secure, /var/log/audit/audit.log and /var/log/messages
> says?
>
> Thanks,
> Pavel.
>
>



More information about the sssd-devel mailing list