Seeking advice for auth required pam_deny.so
Ng Keng Lim <[email protected]> Wed, 2 May 2018 21:07:30 +0000
| Newsgroups | gmane.linux.pam |
|---|---|
| Message-ID | <HK2PR01MB0947CA2C3409C5FA5040FA4F96800@HK2PR01MB0947.apcprd01.prod.exchangelabs.com> |
--===============1438182630203890637==
Content-Language: en-US
Content-Type: multipart/alternative;
boundary="_000_HK2PR01MB0947CA2C3409C5FA5040FA4F96800HK2PR01MB0947apcp_"
--_000_HK2PR01MB0947CA2C3409C5FA5040FA4F96800HK2PR01MB0947apcp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
Hi List,
We currently have the following config in /etc/pam.d/system-auth on a RHEL =
6.3 staging server:
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required pam_env.so
#auth sufficient pam_fprintd.so
#auth sufficient pam_unix.so nullok try_first_pass
#auth requisite pam_succeed_if.so uid >=3D 500 quiet
#auth required pam_deny.so
auth required pam_faillock.so preauth audit silent deny=3D5
auth [success=3D1 default=3Dbad] pam_unix.so
auth [default=3Ddie] pam_faillock.so authfail audit deny=3D5
auth sufficient pam_faillock.so authsucc audit deny=3D5
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
After testing in our staging server, =93su - root=94 and =93sudo su =96 roo=
t=94 command are not working if "auth required pam_deny.so" is enable in /e=
tc/pam.d/system-auth
Would like to check if there are any areas that might be misconfigure.
Thanks.
Regards,
Keng Lim
--_000_HK2PR01MB0947CA2C3409C5FA5040FA4F96800HK2PR01MB0947apcp_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<!-- This file has been automatically generated. See web/README.md -->
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
</head>
<body>
<div id=3D"compose-container" style=3D"direction: ltr" itemscope=3D"" itemt=
ype=3D"https://schema.org/EmailMessage">
<span itemprop=3D"creator" itemscope=3D"" itemtype=3D"https://schema.org/Or=
ganization"><span itemprop=3D"name" content=3D"Outlook Mobile for iOS"></sp=
an></span>
<div>
<div style=3D"direction: ltr;"><span style=3D"font-family: Calibri, sans-se=
rif; font-size: 11pt;">Hi List,</span></div>
<div class=3D"gmail_quote">
<div class=3D"WordSection1">
<p class=3D"MsoNormal"> </p>
<p class=3D"MsoNormal">We currently have the following config in /etc/pam.d=
/system-auth on a RHEL 6.3 staging server:</p>
<p class=3D"MsoNormal"> </p>
<p class=3D"MsoNormal">#%PAM-1.0</p>
<p class=3D"MsoNormal"># This file is auto-generated.</p>
<p class=3D"MsoNormal"># User changes will be destroyed the next time authc=
onfig is run.</p>
<p class=3D"MsoNormal">auth requi=
red pam_env.so</p>
<p class=3D"MsoNormal">#auth sufficient =
pam_fprintd.so</p>
<p class=3D"MsoNormal">#auth sufficient =
pam_unix.so nullok try_first_pass</p>
<p class=3D"MsoNormal">#auth requisite &=
nbsp; pam_succeed_if.so uid >=3D 500 quiet</p>
<p class=3D"MsoNormal">#auth required &n=
bsp; pam_deny.so</p>
<p class=3D"MsoNormal">auth requi=
red pam_faillock.so preauth audit silent deny=
=3D5</p>
<p class=3D"MsoNormal">auth [succ=
ess=3D1 default=3Dbad] pam_unix.so</p>
<p class=3D"MsoNormal">auth [defa=
ult=3Ddie] pam_faillock.so authfail audit deny=3D5</p>
<p class=3D"MsoNormal">auth suffi=
cient pam_faillock.so authsucc audit deny=3D5</p>
<p class=3D"MsoNormal">account required =
pam_unix.so</p>
<p class=3D"MsoNormal">account sufficient pam_local=
user.so</p>
<p class=3D"MsoNormal">account sufficient pam_succe=
ed_if.so uid < 500 quiet</p>
<p class=3D"MsoNormal">account required =
pam_permit.so</p>
<p class=3D"MsoNormal"> </p>
<p class=3D"MsoNormal">After testing in our staging server, =93su - root=94=
and =93sudo su =96 root=94 command are not working if "auth required =
pam_deny.so" is enable in /etc/pam.d/system-auth</p>
<p class=3D"MsoNormal">Would like to check if there are any areas that migh=
t be misconfigure.</p>
<p class=3D"MsoNormal"> </p>
<p class=3D"MsoNormal">Thanks.</p>
<p class=3D"MsoNormal"> </p>
<p class=3D"MsoNormal">Regards, </p>
<p class=3D"MsoNormal">Keng Lim</p>
<p class=3D"MsoNormal"> </p>
</div>
<br>
<br>
</div>
<style><!--@font-face {font-family:Latha}@font-face {font-family:"Cambria M=
ath"}@font-face {font-family:DengXian}@font-face {font-family:Calibri}@font=
-face {}p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom=
:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif}a:link, span.M=
soHyperlink {color:#0563C1; text-decoration:underline}a:visited, span.MsoHy=
perlinkFollowed {color:#954F72; text-decoration:underline}span.EmailStyle17=
{font-family:"Calibri",sans-serif; color:windowtext}.MsoChpDefault {}@page=
WordSection1 {margin:1.0in 1.0in 1.0in 1.0in}div.WordSection1 {}--></style=
></div>
</div>
</body>
</html>
--_000_HK2PR01MB0947CA2C3409C5FA5040FA4F96800HK2PR01MB0947apcp_--
--===============1438182630203890637==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Pam-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/pam-list
--===============1438182630203890637==--