You are not logged in.

Pages: 1

#1 2021-06-24 07:07:22

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

[Solved] Difference between Ubuntu and Arch pam.d config

Hi Arch Linux community

I'm using Arch Linux since quite some years. At a new workplace, the standard setup is Ubuntu 18 with kerberos/LDAP login. As I want to use Arch Linux, I got the LDAP, kerberos, pam, etc. settings from the system administrator. I followed the Kerberos guide and the LDAP guide and the setup seems to work.

Since login with a kerberos user doesn't work with gdm, I had a look in the gdm logs (journalctl -u gdm) and discovered the following:

Jun 24 08:01:43 Andreas-Arch-Linux systemd[1]: Starting GNOME Display Manager...
Jun 24 08:01:43 Andreas-Arch-Linux systemd[1]: Started GNOME Display Manager.
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM (other) illegal module type: @include
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM pam_parse: expecting return value; [...common-auth]
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM (other) no module name supplied
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM (other) illegal module type: @include
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM pam_parse: expecting return value; [...common-account]
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM (other) no module name supplied
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM (other) illegal module type: @include
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM pam_parse: expecting return value; [...common-password]
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM (other) no module name supplied
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM (other) illegal module type: @include
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM pam_parse: expecting return value; [...common-session]
Jun 24 08:01:43 Andreas-Arch-Linux gdm-launch-environment][408]: PAM (other) no module name supplied
Jun 24 08:01:44 Andreas-Arch-Linux gdm[391]: Gdm: GdmDisplay: Session never registered, failing
Jun 24 08:01:44 Andreas-Arch-Linux gdm[391]: Gdm: Child process -421 was already dead.
Jun 24 08:01:44 Andreas-Arch-Linux gdm[391]: Gdm: Child process -421 was already dead.
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM (other) illegal module type: @include
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM pam_parse: expecting return value; [...common-auth]
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM (other) no module name supplied
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM (other) illegal module type: @include
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM pam_parse: expecting return value; [...common-account]
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM (other) no module name supplied
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM (other) illegal module type: @include
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM pam_parse: expecting return value; [...common-password]
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM (other) no module name supplied
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM (other) illegal module type: @include
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM pam_parse: expecting return value; [...common-session]
Jun 24 08:01:44 Andreas-Arch-Linux gdm-launch-environment][442]: PAM (other) no module name supplied
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM (other) illegal module type: @include
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM pam_parse: expecting return value; [...common-auth]
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM (other) no module name supplied
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM (other) illegal module type: @include
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM pam_parse: expecting return value; [...common-account]
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM (other) no module name supplied
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM (other) illegal module type: @include
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM pam_parse: expecting return value; [...common-password]
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM (other) no module name supplied
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM (other) illegal module type: @include
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM pam_parse: expecting return value; [...common-session]
Jun 24 08:04:31 Andreas-Arch-Linux gdm-password][794]: PAM (other) no module name supplied
Jun 24 08:04:33 Andreas-Arch-Linux gdm-password][794]: pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/tty1 ruser= rhost=  user=ziegler
Jun 24 08:04:33 Andreas-Arch-Linux gdm-password][794]: pam_systemd_home(gdm-password:auth): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM (other) illegal module type: @include
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM pam_parse: expecting return value; [...common-auth]
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM (other) no module name supplied
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM (other) illegal module type: @include
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM pam_parse: expecting return value; [...common-account]
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM (other) no module name supplied
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM (other) illegal module type: @include
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM pam_parse: expecting return value; [...common-password]
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM (other) no module name supplied
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM (other) illegal module type: @include
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM pam_parse: expecting return value; [...common-session]
Jun 24 08:04:38 Andreas-Arch-Linux gdm-password][800]: PAM (other) no module name supplied

I read on the web that pam configs vary between Linux distributions. As the 

@include

seems to be the problem, I would like to know the correct syntax for Arch Linux or how I have to change the config.

Thanks for you help in advance,

Cheers,
Andreas

Last edited by AndreasZiegler (2021-06-30 16:50:33)

Offline

#2 2021-06-24 07:16:23

loqs
Member
Registered: 2014-03-06
Posts: 19,009

Re: [Solved] Difference between Ubuntu and Arch pam.d config

See pam.d.5 specifically include and substack also PAM#PAM_base-stack.

Offline

#3 2021-06-24 14:13:45

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

loqs wrote:

See pam.d.5 specifically include and substack also PAM#PAM_base-stack.

I had a look at pam.d.5 and changed all the 

@include

to 

include

since 

include

seems to be a valid control value. However, this doesn't seem to be the case as my gdm logs now complain about the 

include

.

Jun 24 16:02:39 Andreas-Arch-Linux systemd[1]: Starting GNOME Display Manager...
Jun 24 16:02:39 Andreas-Arch-Linux systemd[1]: Started GNOME Display Manager.
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM (other) illegal module type: include
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM pam_parse: expecting return value; [...common-auth]
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM (other) no module name supplied
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM (other) illegal module type: include
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM pam_parse: expecting return value; [...common-account]
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM (other) no module name supplied
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM (other) illegal module type: include
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM pam_parse: expecting return value; [...common-password]
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM (other) no module name supplied
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM (other) illegal module type: include
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM pam_parse: expecting return value; [...common-session]
Jun 24 16:02:40 Andreas-Arch-Linux gdm-launch-environment][403]: PAM (other) no module name supplied
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM (other) illegal module type: include
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM pam_parse: expecting return value; [...common-auth]
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM (other) no module name supplied
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM (other) illegal module type: include
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM pam_parse: expecting return value; [...common-account]
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM (other) no module name supplied
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM (other) illegal module type: include
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM pam_parse: expecting return value; [...common-password]
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM (other) no module name supplied
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM (other) illegal module type: include
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM pam_parse: expecting return value; [...common-session]
Jun 24 16:04:00 Andreas-Arch-Linux gdm-password][673]: PAM (other) no module name supplied
Jun 24 16:04:03 Andreas-Arch-Linux gdm-password][673]: pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/tty1 ruser= rhost=  user=ziegler
Jun 24 16:04:03 Andreas-Arch-Linux gdm-password][673]: pam_systemd_home(gdm-password:auth): systemd-homed is not available: Unit dbus-org.freedesktop.home1.service not found.
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM (other) illegal module type: include
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM pam_parse: expecting return value; [...common-auth]
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM (other) no module name supplied
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM (other) illegal module type: include
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM pam_parse: expecting return value; [...common-account]
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM (other) no module name supplied
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM (other) illegal module type: include
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM pam_parse: expecting return value; [...common-password]
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM (other) no module name supplied
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM (other) illegal module type: include
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM pam_parse: expecting return value; [...common-session]
Jun 24 16:04:07 Andreas-Arch-Linux gdm-password][679]: PAM (other) no module name supplied
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM (other) illegal module type: include
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM pam_parse: expecting return value; [...common-auth]
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM (other) no module name supplied
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM (other) illegal module type: include
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM pam_parse: expecting return value; [...common-account]
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM (other) no module name supplied
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM (other) illegal module type: include
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM pam_parse: expecting return value; [...common-password]
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM (other) no module name supplied
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM (other) illegal module type: include
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM pam_parse: expecting return value; [...common-session]
Jun 24 16:04:10 Andreas-Arch-Linux gdm-password][683]: PAM (other) no module name supplied
Jun 24 16:04:13 Andreas-Arch-Linux gdm-password][683]: gkr-pam: unable to locate daemon control file

Any further hints about the 

include

are welcome.

Last edited by AndreasZiegler (2021-06-24 14:15:01)

Offline

#4 2021-06-24 14:25:27

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

include and @include are not the same thing, the syntax and meaning is vastly different.
Please post the offending pam module as well as the files it tries to include.

Edit, for clarity: @include is a debian deprecated downstream patch thing.

Last edited by seth (2021-06-24 14:27:52)

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#5 2021-06-24 14:34:34

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

Please find the configs below. I hope I got them all. Let me know if not. I'm not very familiar with either pam, kerberos or LDAP and also not with their configs and syntax.

/etc/pam.d/login

#
# The PAM configuration file for the Shadow `login' service
#

# Enforce a minimal delay in case of failure (in microseconds).
# (Replaces the `FAIL_DELAY' setting from login.defs)
# Note that other modules may require another minimal delay. (for example,
# to disable any delay, you should add the nodelay option to pam_unix)
auth       optional   pam_faildelay.so  delay=3000000

# Outputs an issue file prior to each login prompt (Replaces the
# ISSUE_FILE option from login.defs). Uncomment for use
# auth       required   pam_issue.so issue=/etc/issue

# Disallows other than root logins when /etc/nologin exists
# (Replaces the `NOLOGINS_FILE' option from login.defs)
auth       requisite  pam_nologin.so

# SELinux needs to be the first session rule. This ensures that any
# lingering context has been cleared. Without this it is possible
# that a module could execute code in the wrong domain.
# When the module is present, "required" would be sufficient (When SELinux
# is disabled, this returns success.)
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close

# Sets the loginuid process attribute
session    required     pam_loginuid.so

# Prints the message of the day upon successful login.
# (Replaces the `MOTD_FILE' option in login.defs)
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session    optional   pam_motd.so motd=/run/motd.dynamic
session    optional   pam_motd.so noupdate

# SELinux needs to intervene at login time to ensure that the process
# starts in the proper default security context. Only sessions which are
# intended to run in the user's context should be run after this.
# pam_selinux.so changes the SELinux context of the used TTY and configures
# SELinux in order to transition to the user context with the next execve()
# call.
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
# When the module is present, "required" would be sufficient (When SELinux
# is disabled, this returns success.)

# This module parses environment configuration file(s)
# and also allows you to use an extended config
# file /etc/security/pam_env.conf.
# 
# parsing /etc/environment needs "readenv=1"
session       required   pam_env.so readenv=1
# locale variables are also kept into /etc/default/locale in etch
# reading this file *in addition to /etc/environment* does not hurt
session       required   pam_env.so readenv=1 envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# This allows certain extra groups to be granted to a user
# based on things like time of day, tty, service, and user.
# Please edit /etc/security/group.conf to fit your needs
# (Replaces the `CONSOLE_GROUPS' option in login.defs)
auth       optional   pam_group.so

# Uncomment and edit /etc/security/time.conf if you need to set
# time restraint on logins.
# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
# as well as /etc/porttime)
# account    requisite  pam_time.so

# Uncomment and edit /etc/security/access.conf if you need to
# set access limits.
# (Replaces /etc/login.access file)
# account  required       pam_access.so

# Sets up user limits according to /etc/security/limits.conf
# (Replaces the use of /etc/limits in old login)
session    required   pam_limits.so

# Prints the last login info upon successful login
# (Replaces the `LASTLOG_ENAB' option from login.defs)
session    optional   pam_lastlog.so

# Prints the status of the user's mailbox upon successful login
# (Replaces the `MAIL_CHECK_ENAB' option from login.defs). 
#
# This also defines the MAIL environment variable
# However, userdel also needs MAIL_DIR and MAIL_FILE variables
# in /etc/login.defs to make sure that removing a user 
# also removes the user's mail spool file.
# See comments in /etc/login.defs
session    optional   pam_mail.so standard

# Create a new session keyring.
session    optional   pam_keyinit.so force revoke

# Standard Un*x account and session
@include common-account
@include common-session
@include common-password

/etc/pam.d/common-account

#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
#

# here are the per-package modules (the "Primary" block)
account	[success=1 new_authtok_reqd=done default=ignore]	pam_unix.so 
# here's the fallback if no module succeeds
account	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
account	required			pam_krb5.so minimum_uid=1000
# end of pam-auth-update config

/etc/pam.d/common-session

#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
session	[default=1]			pam_permit.so
# here's the fallback if no module succeeds
session	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session	required			pam_permit.so
# The pam_umask module will set the umask according to the system default in
# /etc/login.defs and user settings, solving the problem of different
# umask settings with different shells, display managers, remote sessions etc.
# See "man pam_umask".
session optional			pam_umask.so
# and here are more per-package modules (the "Additional" block)
session	optional			pam_krb5.so minimum_uid=1000
session	required	pam_unix.so 
session	optional	pam_systemd.so 
session	optional			pam_mkhomedir.so  umask=0077
# end of pam-auth-update config

/etc/pam.d/common-password

#
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords.  The default is pam_unix.

# Explanation of pam_unix options:
#
# The "sha512" option enables salted SHA512 passwords.  Without this option,
# the default is Unix crypt.  Prior releases used the option "md5".
#
# The "obscure" option replaces the old `OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# See the pam_unix manpage for other options.

# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
password	[success=2 default=ignore]	pam_krb5.so minimum_uid=1000
password	[success=1 default=ignore]	pam_unix.so obscure use_authtok try_first_pass sha512
# here's the fallback if no module succeeds
password	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
password	optional	pam_gnome_keyring.so 
# end of pam-auth-update config

Last edited by AndreasZiegler (2021-06-24 14:35:36)

Offline

#6 2021-06-24 14:52:25

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

Don't use any of that. Restore the system /etc/pam.d/login and insert the proper krb5 references there, see https://man.archlinux.org/man/community … _krb5.5.en
You can use "password    [success=2 default=ignore] … "

Edit: or add it to /etc/pam.d/system-auth but that still needs the proper login module restored.

Last edited by seth (2021-06-24 14:55:07)

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#7 2021-06-24 15:06:43

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

Sorry for my pam beginner questions. Can I take these values

auth            sufficient      pam_krb5.so minimum_uid=1000
session         required        pam_krb5.so minimum_uid=1000
account         required        pam_krb5.so minimum_uid=1000
password        sufficient      pam_krb5.so minimum_uid=1000

since the authentication (I guess all the four lines are sort of authentication) should be via kerberos?

Offline

#8 2021-06-24 16:16:31

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

Yes. Sort them into /etc/pam.d/system-auth

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#9 2021-06-25 07:45:45

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

Due to the fact that I'm still unsure in which order I have to add the entries above into /etc/pam.d/system-auth, I thought it is a good idea to follow the steps in Configuring PAM authentication. Since pam_winbind.so was not present, I also installed samba. kinit and klist still seem to work and GDM now complains about different problems. 

Jun 25 09:37:53 Andreas-Arch-Linux systemd[1]: Starting GNOME Display Manager...
Jun 25 09:37:53 Andreas-Arch-Linux systemd[1]: Started GNOME Display Manager.
Jun 25 09:38:05 Andreas-Arch-Linux gdm-password][670]: pam_winbind(gdm-password:auth): getting password (0x00004388)
Jun 25 09:38:08 Andreas-Arch-Linux gdm-password][670]: pam_winbind(gdm-password:auth): request wbcLogonUser failed: WBC_ERR_WINBIND_NOT_AVAILABLE, PAM error: PAM_AUTHINFO_UNAVAIL (9)!
Jun 25 09:38:08 Andreas-Arch-Linux gdm-password][670]: pam_winbind(gdm-password:auth): internal module error (retval = PAM_AUTHINFO_UNAVAIL(9), user = 'ziegler')
Jun 25 09:38:08 Andreas-Arch-Linux gdm-password][670]: pam_unix(gdm-password:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/tty1 ruser= rhost=  user=ziegler
Jun 25 09:38:08 Andreas-Arch-Linux gdm-password][670]: gkr-pam: unable to locate daemon control file
Jun 25 09:38:08 Andreas-Arch-Linux gdm-password][670]: gkr-pam: stashed password to try later in open session
Jun 25 09:38:12 Andreas-Arch-Linux gdm-password][675]: pam_winbind(gdm-password:auth): getting password (0x00004388)
Jun 25 09:38:15 Andreas-Arch-Linux gdm-password][679]: pam_winbind(gdm-password:auth): getting password (0x00004388)
Jun 25 09:38:17 Andreas-Arch-Linux gdm-password][679]: pam_winbind(gdm-password:auth): request wbcLogonUser failed: WBC_ERR_WINBIND_NOT_AVAILABLE, PAM error: PAM_AUTHINFO_UNAVAIL (9)!
Jun 25 09:38:17 Andreas-Arch-Linux gdm-password][679]: pam_winbind(gdm-password:auth): internal module error (retval = PAM_AUTHINFO_UNAVAIL(9), user = 'root')
Jun 25 09:38:17 Andreas-Arch-Linux gdm-password][679]: gkr-pam: unable to locate daemon control file
Jun 25 09:38:17 Andreas-Arch-Linux gdm-password][679]: gkr-pam: stashed password to try later in open session
Jun 25 09:38:17 Andreas-Arch-Linux gdm-password][679]: pam_winbind(gdm-password:account): valid_user: wbcGetpwnam gave WBC_ERR_WINBIND_NOT_AVAILABLE
Jun 25 09:38:17 Andreas-Arch-Linux gdm-password][679]: pam_unix(gdm-password:session): session opened for user root(uid=0) by (uid=0)
Jun 25 09:38:18 Andreas-Arch-Linux gdm-password][679]: pam_env(gdm-password:session): deprecated reading of user environment enabled
Jun 25 09:38:18 Andreas-Arch-Linux gdm-password][679]: gkr-pam: gnome-keyring-daemon started properly and unlocked keyring
Jun 25 09:38:21 Andreas-Arch-Linux gdm[401]: Gdm: Child process -435 was already dead.

Is Configuring PAM authentication  out of date, or did I miss something else?

Offline

#10 2021-06-25 08:08:28

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

It's not pam, but the winbind request fails.

Jun 25 09:38:08 Andreas-Arch-Linux gdm-password][670]: pam_winbind(gdm-password:auth): request wbcLogonUser failed: WBC_ERR_WINBIND_NOT_AVAILABLE, PAM error: PAM_AUTHINFO_UNAVAIL (9)!

Can you post the instructions you got from the admin (obfuscating priate data, login/password etc. is fine)

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#11 2021-06-25 08:49:25

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

seth wrote:

It's not pam, but the winbind request fails.

Jun 25 09:38:08 Andreas-Arch-Linux gdm-password][670]: pam_winbind(gdm-password:auth): request wbcLogonUser failed: WBC_ERR_WINBIND_NOT_AVAILABLE, PAM error: PAM_AUTHINFO_UNAVAIL (9)!

Can you post the instructions you got from the admin (obfuscating priate data, login/password etc. is fine)

As I didn't want to create so many gists, I packed it all. You can get it here.

Last edited by AndreasZiegler (2021-06-25 08:53:59)

Offline

#12 2021-06-25 11:04:59

loqs
Member
Registered: 2014-03-06
Posts: 19,009

Re: [Solved] Difference between Ubuntu and Arch pam.d config

AndreasZiegler wrote:

Is Configuring PAM authentication  out of date, or did I miss something else?

It is not fully updated to reflect the integration of pam_systemd_home.so into the current system-auth.  That does not appear to be the cause of your current issue.

Offline

#13 2021-06-25 11:20:02

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

The ubuntu config files are all about ldap, there's no winbind reference, so there's likely also no server.
I had rather hoped for a "here's what we provide at which ports (and this is about how you somehow configure it on ubuntu)" document - but the Uni Tübingen has a lot of google hits when it comes to ldap and none for winbind. So they're not doing that ;-)

https://wiki.archlinux.org/title/LDAP_a … ient_Setup

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#14 2021-06-27 15:41:58

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

As far as I'm informed, not every department at the University of Tuebingen has the same setup. Due to historical reasons, the department, I'm belonging to, has quite a unique setup within the University landscape.

I guess there is no other way than really dig into the Ubuntu config files and try to apply it to Arch manually.

Offline

#15 2021-06-27 16:38:57

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

There's no winbind in the ubuntu config, only ldap.
If that config works on ubuntu, you don't need winbind and there's no reason to assume there'd be a winbind server

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#16 2021-06-30 13:37:25

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

By adjusting system-auth, I'm now able to login. I had to manually change the home folder to the uid and gid of the kerberos user. One thing that doesn't work yet, is sudo. I added the user to the wheel group but I get the following:

sudo: account validation failure, is your account locked?
sudo: as password is required

Any idea, in which pam setting file I have to adjust something?

I get the following logs with journalctl:

audit[1452]: USER_AUTH pid=1452 uid=xxxxxx auid=xxxxxx ses=3 msg='op=PAM:authentication grantors=pam_permit acct="ziegler" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'
audit[1452]: USER_ACCT pid=1452 uid=xxxxxx auid=xxxxxx ses=3 msg='op=PAM:accounting grantors=? acct="ziegler" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed'

Last edited by AndreasZiegler (2021-06-30 14:15:46)

Offline

#17 2021-06-30 14:25:57

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

/etc/pam.d/sudo, 

…
password         include         system-auth

?

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#18 2021-06-30 14:33:59

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

My /etc/pam.d/sudo is:

#%PAM=1.0
auth             include     system-auth
account        include     system-auth
session        include     system-auth

So I guess, I have to add the password line.

Offline

#19 2021-06-30 14:36:13

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

That was the idea ;-)

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#20 2021-06-30 14:41:50

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

AndreasZiegler wrote:

My /etc/pam.d/sudo is:

#%PAM=1.0
auth             include     system-auth
account        include     system-auth
session        include     system-auth

So I guess, I have to add the password line.

I added the line but it still won't work:

kernel: audit: type=1100 audit(1625063863.090:349): pid=3363 uid=xxx auid=xxx ses=6 msg='op=PAM:authentication grantors=pam_permit acct="ziegler" exe="/usr/bin/sudo" hostname=? addr=? terminal=/de>
kernel: audit: type=1101 audit(1625063863.093:350): pid=3363 uid=xxx auid=xxx ses=6 msg='op=PAM:accounting grantors=? acct="ziegler" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=f>
audit[3363]: USER_AUTH pid=3363 uid=xxx auid=xxx ses=6 msg='op=PAM:authentication grantors=pam_permit acct="ziegler" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
audit[3363]: USER_ACCT pid=3363 uid=xxx auid=xxx ses=6 msg='op=PAM:accounting grantors=? acct="ziegler" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=failed'
sudo[3363]: pam_warn(sudo:account): function=[pam_sm_acct_mgmt] flags=0x8000 service=[sudo] terminal=[/dev/pts/0] user=[ziegler] ruser=[ziegler] rhost=[<unknown>]
sudo[3363]:  ziegler : account validation failure, is your account locked? ; TTY=pts/0 ; PWD=/home/ziegler ; USER=root ; COMMAND=/usr/bin/ls

Offline

#21 2021-06-30 14:59:58

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

accounting grantors=?

What does system-auth actually look like atm?

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#22 2021-06-30 15:02:29

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

This is my /etc/pam.d/system-auth

#%PAM-1.0

# here are the per-package modules (the "Primary" block)
auth	[success=2 default=ignore]	pam_krb5.so minimum_uid=1000
auth	[success=1 default=ignore]	pam_unix.so nullok_secure try_first_pass
# here's the fallback if no module succeeds
auth	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth	optional			pam_cap.so 
# end of pam-auth-update config

# here are the per-package modules (the "Primary" block)
password	[success=2 default=ignore]	pam_krb5.so minimum_uid=1000
password	[success=1 default=ignore]	pam_unix.so obscure use_authtok try_first_pass sha512
# here's the fallback if no module succeeds
password	requisite			pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password	required			pam_permit.so
# and here are more per-package modules (the "Additional" block)
password	optional	pam_gnome_keyring.so 
# end of pam-auth-update config

Offline

#23 2021-06-30 15:06:16

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

Woaw… what happened to the account and session entries?

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

#24 2021-06-30 15:48:56

AndreasZiegler
Member
Registered: 2021-06-24
Posts: 13

Re: [Solved] Difference between Ubuntu and Arch pam.d config

I copied the account and session entries from the ubuntu config into system-auth and now it seems to work. Thanks for spotting the missing entries and your help in general. As a  fresh ldap/kerberos/pam user it would be nice if distros could use some sort of standard.

Offline

#25 2021-06-30 16:18:28

seth
Member
From: Won't reply 2 private help req
Registered: 2012-09-03
Posts: 77,443

Re: [Solved] Difference between Ubuntu and Arch pam.d config

You'd actually just have to inject the kerberos modules into the default system-auth shipped with https://archlinux.org/packages/core/any/pambase/

Please always remember to mark resolved threads by editing your initial posts subject - so others will know that there's no task left, but maybe a solution to find.
Thanks.

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Offline

Pages: 1

Board footer

Powered by FluxBB