You are not logged in.
Pages: 1
Hi all,
I'm trying to join my Arch Linux machine to an Active Directory domain and was succeed. However, I stuck configuring pam.d/system-auth for pam_winbind.so. The problem is, I can successfully authenticate my users, but pam_systemd seems not to be working (for XDG_SESSION_ID is not set, and /run/user/UID/ is not created). I turned debug flags on both pam_winbind and pam_systemd, and tried to login. The log is attached:
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] ENTER: pam_sm_authenticate (flags: 0x0000)
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_SERVICE) = "login" (0x555c81812770)
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER) = "[REDACTED: AD Username]" (0x555c81812790)
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_TTY) = "tty1" (0x555c81841a20)
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER_PROMPT) = "[REDACTED: Hostname] login: " (0x555c81841ba0)
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_CONV) = 0x555c818127b0
login[5393]: pam_winbind(login:auth): getting password (0x00005189)
login[5393]: pam_winbind(login:auth): Verify user '[REDACTED: AD Username]'
login[5393]: pam_winbind(login:auth): CONFIG file: krb5_ccache_type 'FILE:/run/user/%u/krb5cc'
login[5393]: pam_winbind(login:auth): enabling krb5 login flag
login[5393]: pam_winbind(login:auth): enabling request for a FILE:/run/user/%u/krb5cc krb5 ccache
login[5393]: pam_winbind(login:auth): request wbcLogonUser succeeded
login[5393]: pam_winbind(login:auth): user '[REDACTED: AD Username]' granted access
login[5393]: pam_winbind(login:auth): Returned user was '[REDACTED: AD Username]'
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] LEAVE: pam_sm_authenticate returning 0 (PAM_SUCCESS)
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_SERVICE) = "login" (0x555c81812770)
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER) = "[REDACTED: AD Username]" (0x555c81844a50)
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_TTY) = "tty1" (0x555c81841a20)
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_AUTHTOK) = 0x555c818439a0
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER_PROMPT) = "[REDACTED: Hostname] login: " (0x555c81841ba0)
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: ITEM(PAM_CONV) = 0x555c818127b0
login[5393]: pam_winbind(login:auth): [pamh: 0x555c818125e0] STATE: DATA(PAM_WINBIND_LOGONSERVER) = "[REDACTED: Domain controller]" (0x555c81867db0)
audit[5393]: USER_AUTH pid=5393 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=pam_securetty,pam_shells,pam_faillock,pam_winbind acct="[REDACTED: AD Username]" exe="/usr/bin/login" hostname=[REDACTED: Hostname FQDN] addr=? terminal=tty1 res=success'
audit[5393]: USER_ACCT pid=5393 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_permit,pam_time acct="[REDACTED: AD Username]" exe="/usr/bin/login" hostname=[REDACTED: Hostname FQDN] addr=? terminal=tty1 res=success'
login[5393]: pam_unix(login:account): password for user [REDACTED: AD Username] will expire in 0 days
kernel: audit: type=1100 audit(1600898616.341:1338): pid=5393 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=pam_securetty,pam_shells,pam_faillock,pam_winbind acct="[REDACTED: AD Username]" exe="/usr/bin/login" hostname=[REDACTED: Hostname FQDN] addr=? terminal=tty1 res=success'
kernel: audit: type=1101 audit(1600898616.341:1339): pid=5393 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_permit,pam_time acct="[REDACTED: AD Username]" exe="/usr/bin/login" hostname=[REDACTED: Hostname FQDN] addr=? terminal=tty1 res=success'
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] ENTER: pam_sm_setcred (flags: 0x0002)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_SERVICE) = "login" (0x555c81812770)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER) = "[REDACTED: AD Username]" (0x555c81844a50)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_TTY) = "tty1" (0x555c81841a20)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER_PROMPT) = "[REDACTED: Hostname] login: " (0x555c81841ba0)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_CONV) = 0x555c818127b0
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: DATA(PAM_WINBIND_LOGONSERVER) = "[REDACTED: Domain controller]" (0x555c81867db0)
login[5393]: pam_winbind(login:setcred): PAM_ESTABLISH_CRED not implemented
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] LEAVE: pam_sm_setcred returning 0 (PAM_SUCCESS)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_SERVICE) = "login" (0x555c81812770)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER) = "[REDACTED: AD Username]" (0x555c81844a50)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_TTY) = "tty1" (0x555c81841a20)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER_PROMPT) = "[REDACTED: Hostname] login: " (0x555c81841ba0)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_CONV) = 0x555c818127b0
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: DATA(PAM_WINBIND_LOGONSERVER) = "[REDACTED: Domain controller]" (0x555c81867db0)
audit[5393]: CRED_ACQ pid=5393 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_securetty,pam_shells,pam_faillock,pam_winbind acct="[REDACTED: AD Username]" exe="/usr/bin/login" hostname=[REDACTED: Hostname FQDN] addr=? terminal=tty1 res=success'
kernel: audit: type=1103 audit(1600898616.344:1340): pid=5393 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_securetty,pam_shells,pam_faillock,pam_winbind acct="[REDACTED: AD Username]" exe="/usr/bin/login" hostname=[REDACTED: Hostname FQDN] addr=? terminal=tty1 res=success'
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] ENTER: pam_sm_open_session (flags: 0x0000)
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: ITEM(PAM_SERVICE) = "login" (0x555c81812770)
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER) = "[REDACTED: AD Username]" (0x555c81844a50)
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: ITEM(PAM_TTY) = "tty1" (0x555c81841a20)
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER_PROMPT) = "[REDACTED: Hostname] login: " (0x555c81841ba0)
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: ITEM(PAM_CONV) = 0x555c818127b0
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: DATA(PAM_WINBIND_LOGONSERVER) = "[REDACTED: Domain controller]" (0x555c81867db0)
login[5393]: pam_winbind(login:session): homedir is: /home/[REDACTED: AD Username]
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] LEAVE: pam_sm_open_session returning 0 (PAM_SUCCESS)
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: ITEM(PAM_SERVICE) = "login" (0x555c81812770)
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER) = "[REDACTED: AD Username]" (0x555c81844a50)
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: ITEM(PAM_TTY) = "tty1" (0x555c81841a20)
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER_PROMPT) = "[REDACTED: Hostname] login: " (0x555c81841ba0)
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: ITEM(PAM_CONV) = 0x555c818127b0
login[5393]: pam_winbind(login:session): [pamh: 0x555c818125e0] STATE: DATA(PAM_WINBIND_LOGONSERVER) = "[REDACTED: Domain controller]" (0x555c81867db0)
kernel: audit: type=1006 audit(1600898616.348:1341): pid=5393 uid=0 old-auid=4294967295 auid=10007 tty=tty1 old-ses=4294967295 ses=40 res=1
login[5393]: pam_unix(login:session): session opened for user [REDACTED: AD Username](uid=10007) by LOGIN(uid=0)
login[5393]: pam_systemd(login:session): pam-systemd initializing
login[5393]: pam_systemd(login:session): Asking logind to create session: uid=10007 pid=5393 service=login type=tty class=user desktop= seat= vtnr=0 tty=tty1 display= remote=no remote_user= remote_host=
login[5393]: pam_systemd(login:session): Session limits: memory_max=n/a tasks_max=n/a cpu_weight=n/a io_weight=n/a runtime_max_sec=n/a
[b]login[5393]: pam_systemd(login:session): Failed to create session: No such process[/b]
audit[5393]: USER_START pid=5393 uid=0 auid=10007 ses=40 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_winbind,pam_unix,pam_permit,pam_mail,pam_env acct="[REDACTED: AD Username]" exe="/usr/bin/login" hostname=[REDACTED: Hostname FQDN] addr=? terminal=tty1 res=success'
audit[5393]: CRED_REFR pid=5393 uid=0 auid=10007 ses=40 msg='op=PAM:setcred grantors=pam_securetty,pam_shells,pam_faillock,pam_winbind acct="[REDACTED: AD Username]" exe="/usr/bin/login" hostname=[REDACTED: Hostname FQDN] addr=? terminal=tty1 res=success'
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] ENTER: pam_sm_setcred (flags: 0x0008)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_SERVICE) = "login" (0x555c81812770)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER) = "[REDACTED: AD Username]" (0x555c81844a50)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_TTY) = "tty1" (0x555c81841a20)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER_PROMPT) = "[REDACTED: Hostname] login: " (0x555c81841ba0)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_CONV) = 0x555c818127b0
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: DATA(PAM_WINBIND_LOGONSERVER) = "[REDACTED: Domain controller]" (0x555c81867db0)
login[5393]: pam_winbind(login:setcred): PAM_REINITIALIZE_CRED not implemented
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] LEAVE: pam_sm_setcred returning 0 (PAM_SUCCESS)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_SERVICE) = "login" (0x555c81812770)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER) = "[REDACTED: AD Username]" (0x555c81844a50)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_TTY) = "tty1" (0x555c81841a20)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_USER_PROMPT) = "[REDACTED: Hostname] login: " (0x555c81841ba0)
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: ITEM(PAM_CONV) = 0x555c818127b0
login[5393]: pam_winbind(login:setcred): [pamh: 0x555c818125e0] STATE: DATA(PAM_WINBIND_LOGONSERVER) = "[REDACTED: Domain controller]" (0x555c81867db0)
kernel: audit: type=1105 audit(1600898616.354:1342): pid=5393 uid=0 auid=10007 ses=40 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_winbind,pam_unix,pam_permit,pam_mail,pam_env acct="[REDACTED: AD Username]" exe="/usr/bin/login" hostname=[REDACTED: Hostname FQDN] addr=? terminal=tty1 res=success'
kernel: audit: type=1110 audit(1600898616.354:1343): pid=5393 uid=0 auid=10007 ses=40 msg='op=PAM:setcred grantors=pam_securetty,pam_shells,pam_faillock,pam_winbind acct="[REDACTED: AD Username]" exe="/usr/bin/login" hostname=[REDACTED: Hostname FQDN] addr=? terminal=tty1 res=success'
login[5393]: LOGIN ON tty1 BY [REDACTED: AD Username]My system-auth pam configuration is:
#%PAM-1.0
auth required pam_faillock.so preauth
[b]auth sufficient pam_winbind.so[/b]
auth [success=2 default=ignore] pam_unix.so try_first_pass nullok
-auth [success=1 default=ignore] pam_systemd_home.so
auth [default=die] pam_faillock.so authfail
auth optional pam_permit.so
auth required pam_env.so
auth required pam_faillock.so authsucc
-account [success=1 default=ignore] pam_systemd_home.so
[b]account sufficient pam_winbind.so[/b]
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so
-password [success=1 default=ignore] pam_systemd_home.so
[b]password sufficient pam_winbind.so[/b]
password required pam_unix.so try_first_pass nullok shadow
password optional pam_permit.so
session required pam_limits.so
[b]session required pam_winbind.so[/b]
session required pam_unix.so
session optional pam_permit.soAre there any mistakes I made in configuring? Thank you very much.
Last edited by YuutaW (2020-09-23 22:40:14)
Offline
#%PAM-1.0
auth required pam_faillock.so preauth
auth [success=3 default=ignore] pam_winbind.so
auth [success=2 default=ignore] pam_unix.so try_first_pass nullok
-auth [success=1 default=ignore] pam_systemd_home.so
auth [default=die] pam_faillock.so authfail
auth optional pam_permit.so
auth required pam_env.so
auth required pam_faillock.so authsucc
-account [success=2 default=ignore] pam_winbind.so
account [success=1 default=ignore] pam_systemd_home.so
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so
-password [success=2 default=ignore] pam_winbind.so
password [success=1 default=ignore] pam_systemd_home.so
password required pam_unix.so try_first_pass nullok shadow
password optional pam_permit.so
session required pam_limits.so
session required pam_winbind.so
session required pam_unix.so
session optional pam_permit.soIf you change to the above which avoids using sufficient which ends the stack early and places pam_winbind before pam_systemd_homed is there any difference?
Please use code tags for commands and their outputs.
Offline
If you change to the above which avoids using sufficient which ends the stack early and places pam_winbind before pam_systemd_homed is there any difference?
Thanks for your help, but it does not seems to work...
Please use code tags for commands and their outputs.
Thanks, I'll use code tag for further posts.
Offline
Does not seem to work as in worse than the original configuration?
Offline
Does not seem to work as in worse than the original configuration?
I checked the log and it shows the same:
login[5438]: pam_unix(login:session): session opened for user [REDACTED: AD Username](uid=10007) by LOGIN(uid=0)
login[5438]: pam_systemd(login:session): pam-systemd initializing
login[5438]: pam_systemd(login:session): Asking logind to create session: uid=10007 pid=5438 service=login type=tty class=user desktop= seat= vtnr=0 tty=tty1 display= remote=no remote_user= remote_host=
login[5438]: pam_systemd(login:session): Session limits: memory_max=n/a tasks_max=n/a cpu_weight=n/a io_weight=n/a runtime_max_sec=n/a
login[5438]: pam_systemd(login:session): Failed to create session: No such processHope this helps.
Last edited by YuutaW (2020-09-23 22:50:06)
Offline
If you test with a local user does that have the same issue?
If the issue is limited to active directory users, is the user's home directory created/accessible?
Last edited by loqs (2020-09-23 22:54:27)
Offline
If you test with a local user does that have the same issue?
There is no issues with local users. A normal log would be:
sshd[5525]: pam_systemd(sshd:session): pam-systemd initializing
sshd[5525]: pam_systemd(sshd:session): Asking logind to create session: uid=1000 pid=5525 service=sshd type=tty class=user desktop= seat= vtnr=0 tty= display= remote=yes remote_user= remote_host=[REDACTED]
sshd[5525]: pam_systemd(sshd:session): Session limits: memory_max=n/a tasks_max=n/a cpu_weight=n/a io_weight=n/a runtime_max_sec=n/a
sshd[5525]: pam_systemd(sshd:session): Reply from logind: id=42 object_path=/org/freedesktop/login1/session/_342 runtime_path=/run/user/1000 session_fd=7 seat= vtnr=0 original_uid=1000
audit[5525]: USER_START pid=5525 uid=0 auid=1000 ses=42 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_winbind,pam_unix,pam_permit,pam_mail,pam_systemd,pam_env acct="[REDACTED: Local username]" exe="/usr/bin/sshd" hostname=[REDACTED] addr=[REDACTED] terminal=ssh res=success'Although the login attempt above is over SSH, login via tty works as well.
If the issue is limited to active directory users, is the user's home directory created/accessible?
Yes. The AD user can successfully authenticate and their home directory is automatically created by pam_winbind with appropriate owner/group and permissions. Also, pam_env works.
Last edited by YuutaW (2020-09-23 22:59:20)
Offline
Wait... It's pretty wired that it works suddenly. The only operation I tried is to enable verbose logging for systemd-logind and restart it. After that, I tried to login, and it told me that pam_systemd(login:session): Not creating session: Already occupied by a session... After a reboot, it works pretty well. I also tried to remove the verbose logging setting, and it still works... I don't know why, but in conclusion it works.
Offline
If you boot with systemd.log_level=7 that will produce debug logging from systemd, be warned it is very verbose.
Offline
If you boot with systemd.log_level=7 that will produce debug logging from systemd, be warned it is very verbose.
Thank you. I'll use that next time if I encounter the similar issue.
Offline
Confirmed by setting up another domain-joined Arch Linux instance. After adjusting pam.d, you have to restart systemd-logind, or sessions will not be created.
Offline
Pages: 1