[SSSD-users] pam_sss returns PAM_SYSTEM_ERR when entering wrong Kerberos password

Dmitri Pal dpal at redhat.com
Fri Sep 7 17:58:52 UTC 2012


On 09/07/2012 11:44 AM, Joschi Brauchle wrote:
> Hello,
>
> I noticed a problem when using pam_sss (1.8.3) under OpenSUSE 12.2 +
> KDE and filed a bugreport there:
> https://bugzilla.novell.com/show_bug.cgi?id=779246
>
> When a Kerberos user enters a wrong password, a KDM "Critical error"
> message pops up (see link above for a screenshot).
>
> In /var/log/messages, there is
> ------
> Sep  7 11:34:03 test-os122 [sssd[krb5_child[1102]]]: Decrypt integrity
> check
> failed
> Sep  7 11:34:03 test-os122 [sssd[krb5_child[1102]]]: Decrypt integrity
> check
> failed
> Sep  7 11:34:03 test-os122 kdm: :0[1085]: pam_sss(xdm:auth): system info:
> [Decrypt integrity check failed]
> Sep  7 11:34:03 test-os122 kdm: :0[1085]: pam_sss(xdm:auth):
> authentication
> failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=testuser
> Sep  7 11:34:03 test-os122 kdm: :0[1085]: pam_sss(xdm:auth): received
> for user
> testuser: 4 (System error)
> ------
>
> As far as I know, "decrypt integrity fails" is the default Kerberos
> error message for a wrong password. Hence, this is not a "System
> error", but rather an authentication error.
>
> When looking at the code of "krb5_child.c", it seems like the default
> return code when checking the Kerberos TGT is "PAM_SYSTEM_ERR", which
> also gets returned in the event of a simply wrong password.
>
> I guess, pam_sss should instead return "PAM_AUTH_ERR", is that correct?
> Has this been fixed in versions > 1.8.3?
>
> Best regards,
> Joschi Brauchle
>
>
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
You can check the latest code here: http://git.fedorahosted.org/git/sssd
If it is still not fixed please file a ticket:
https://fedorahosted.org/sssd/

Thank you for your help!

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20120907/e65babda/attachment.html>


More information about the sssd-users mailing list