Arch Linux

adambot

Member

Registered: 2012-01-24

Posts: 32

PAM authentication issue with winbind

Greetings,

I used the wiki entry here: https://wiki.archlinux.org/index.php/Ar … _Directory and looking at the auth.log it seems like winbind is working fine (which i have also proved on the command line) however, something seems to be wrong with PAM.

here is the log entries:
Jan 24 10:54:49 phantom login[540]: pam_winbind(login:auth): getting password (0x00000012)
Jan 24 10:54:49 phantom login[540]: pam_winbind(login:auth): pam_get_item returned a password
Jan 24 10:54:49 phantom login[540]: pam_winbind(login:auth): user 'testuser' granted access
Jan 24 10:54:49 phantom login[540]: Permission denied

here is my /etc/pam.d/login:

#%PAM-1.0
auth		sufficient	pam_unix2.so
auth		required	pam_winbind.so use_first_pass use_authtok
auth		required	pam_securetty.so
auth		required	pam_nologin.so
# use this to lockout accounts for 10 minutes after 3 failed attempts
#auth		required	pam_tally.so deny=2 unlock_time=600 onerr=succeed file=/var/log/faillog
#account		required	pam_access.so
account		sufficient	pam_unix2.so
account		sufficient	pam_winbind.so use_first_pass use_authtok
#password	required	pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
#password	required	pam_unix2.so sha512 shadow use_authtok
password	required	pam_pwcheck.so
password	sufficient	pam_unix2.so
password	sufficient	pam_winbind.so use_first_pass use_authtok
session		required	pam_mkhomedir.so skel=/etc/skel/ umask=0022
session		sufficient	pam_unix2.so
session		sufficient	pam_winbind.so use_first_pass use_authtok
session		required	pam_limits.so

EDIT:
i added debug to the end of every line in login and replaced login with the one from the wiki (copy and paste, so no typos) so now my login looks like this:

#### /etc/pam.d/login ####
##%PAM-1.0
auth     sufficient     pam_unix2.so debug
auth     sufficient     pam_winbind.so use_first_pass use_authtok debug
auth     required       pam_securetty.so debug
auth     required       pam_nologin.so debug
auth     required       pam_mail.so debug
account  sufficient     pam_unix2.so debug
account  sufficient     pam_winbind.so use_first_pass use_authtok debug
password required       pam_pwcheck.so debug
password sufficient     pam_unix2.so debug
password sufficient     pam_winbind.so use_first_pass use_authtok debug
session  required       pam_mkhomedir.so skel=/etc/skel/ umask=0022 debug
session  sufficient     pam_unix2.so debug
session  sufficient     pam_winbind.so use_first_pass use_authtok debug
session  required       pam_limits.so debug

and the errors now look like this:
Jan 24 14:42:12 phantom login[2750]: pam_unix2(login:auth): pam_sm_authenticate() called
Jan 24 14:42:12 phantom login[2750]: pam_unix2(login:auth): username=[testuser]
Jan 24 14:42:12 phantom login[2750]: pam_unix2(login:auth): Cannot find passwd entry for testuser
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:auth): [pamh: 0x2428460] ENTER: pam_sm_authenticate (flags: 0x0000)
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:auth): getting password (0x00000013)
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:auth): pam_get_item returned a password
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:auth): Verify user 'testuser'
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:auth): request wbcLogonUser succeeded
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:auth): user 'testuser' granted access
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:auth): Returned user was 'testuser'
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:auth): [pamh: 0x2428460] LEAVE: pam_sm_authenticate returning 0 (PAM_SUCCESS)
Jan 24 14:42:18 phantom login[2750]: pam_unix2(login:account): pam_sm_acct_mgmt() called
Jan 24 14:42:18 phantom login[2750]: pam_unix2(login:account): username=[testuser]
Jan 24 14:42:18 phantom login[2750]: pam_unix2(login:account): Cannot find passwd entry for testuser
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:account): [pamh: 0x2428460] ENTER: pam_sm_acct_mgmt (flags: 0x0000)
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:account): user 'testuser' not found
Jan 24 14:42:18 phantom login[2750]: pam_winbind(login:account): [pamh: 0x2428460] LEAVE: pam_sm_acct_mgmt returning 10 (PAM_USER_UNKNOWN)
Jan 24 14:42:18 phantom login[2750]: Permission denied

Last edited by adambot (2012-01-24 20:45:34)