[SSSD] sssd_be not telling user account is locked?

Jakub Hrozek jhrozek at redhat.com
Wed Nov 27 20:24:26 UTC 2013


On Wed, Nov 27, 2013 at 05:13:50PM +0000, Viviano, Brad wrote:
> Changing the pam_verbosity to 2 or 3 had no affect.  It doesn't tell the user their account is locked but everything shows up in syslog or sssd domain log fine.
> 
> I've looked through pam_sss.c and if I am understanding correctly, this block of code seems to be what is putting the message into syslog:
> 
>             case SSS_PAM_SYSTEM_INFO:
>                 if (buf[p + (len -1)] != '\0') {
>                     D(("system info does not end with \\0."));
>                     break;
>                 }
>                 logger(pamh, LOG_INFO, "system info: [%s]", &buf[p]);
>                 break;
> 
> The the account locked message is coming back from the BE tagged as SSS_PAM_SYSTEM_INFO instead of SSS_PAM_USER_INFO which is where the other messages related to expired passwords, grace logins, etc get processed.  So I suspect there is no way to let the user know there account is locked directly since there is no corrasponding user message function in pam_sss.c.
> 
> But if I am wrong, please let me know :).

You're completely right, I verified that using my setup.

I'd advise to file a RFE, on one hand I don't think the message should
be visible by default, on the other hand, I think that's something we
should allow to be displayed with a higher pam_verbosity.



More information about the sssd-devel mailing list