Seeking advice for auth required pam_deny.so

Ng Keng Lim <[email protected]> Wed, 2 May 2018 21:07:30 +0000
Newsgroups gmane.linux.pam
Message-ID <HK2PR01MB0947CA2C3409C5FA5040FA4F96800@HK2PR01MB0947.apcprd01.prod.exchangelabs.com>
--===============1438182630203890637==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_HK2PR01MB0947CA2C3409C5FA5040FA4F96800HK2PR01MB0947apcp_"

--_000_HK2PR01MB0947CA2C3409C5FA5040FA4F96800HK2PR01MB0947apcp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Hi List,

We currently have the following config in /etc/pam.d/system-auth on a RHEL =
6.3 staging server:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
#auth      sufficient    pam_fprintd.so
#auth      sufficient    pam_unix.so nullok try_first_pass
#auth      requisite     pam_succeed_if.so uid >=3D 500 quiet
#auth      required      pam_deny.so
auth        required      pam_faillock.so preauth audit silent deny=3D5
auth        [success=3D1 default=3Dbad] pam_unix.so
auth        [default=3Ddie] pam_faillock.so authfail audit deny=3D5
auth        sufficient    pam_faillock.so authsucc audit deny=3D5
account  required      pam_unix.so
account  sufficient    pam_localuser.so
account  sufficient    pam_succeed_if.so uid < 500 quiet
account  required      pam_permit.so

After testing in our staging server, =93su - root=94 and =93sudo su =96 roo=
t=94 command are not working if "auth required pam_deny.so" is enable in /e=
tc/pam.d/system-auth
Would like to check if there are any areas that might be misconfigure.

Thanks.

Regards,
Keng Lim




--_000_HK2PR01MB0947CA2C3409C5FA5040FA4F96800HK2PR01MB0947apcp_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<!-- This file has been automatically generated. See web/README.md -->
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
</head>
<body>
<div id=3D"compose-container" style=3D"direction: ltr" itemscope=3D"" itemt=
ype=3D"https://schema.org/EmailMessage">
<span itemprop=3D"creator" itemscope=3D"" itemtype=3D"https://schema.org/Or=
ganization"><span itemprop=3D"name" content=3D"Outlook Mobile for iOS"></sp=
an></span>
<div>
<div style=3D"direction: ltr;"><span style=3D"font-family: Calibri, sans-se=
rif; font-size: 11pt;">Hi List,</span></div>
<div class=3D"gmail_quote">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">&nbsp;</p>
<p class=3D"MsoNormal">We currently have the following config in /etc/pam.d=
/system-auth on a RHEL 6.3 staging server:</p>
<p class=3D"MsoNormal">&nbsp;</p>
<p class=3D"MsoNormal">#%PAM-1.0</p>
<p class=3D"MsoNormal"># This file is auto-generated.</p>
<p class=3D"MsoNormal"># User changes will be destroyed the next time authc=
onfig is run.</p>
<p class=3D"MsoNormal">auth&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; requi=
red&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; pam_env.so</p>
<p class=3D"MsoNormal">#auth&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sufficient&nbsp;=
&nbsp;&nbsp; pam_fprintd.so</p>
<p class=3D"MsoNormal">#auth&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sufficient&nbsp;=
&nbsp;&nbsp; pam_unix.so nullok try_first_pass</p>
<p class=3D"MsoNormal">#auth&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; requisite&nbsp;&=
nbsp;&nbsp;&nbsp; pam_succeed_if.so uid &gt;=3D 500 quiet</p>
<p class=3D"MsoNormal">#auth&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; required&nbsp;&n=
bsp;&nbsp;&nbsp;&nbsp; pam_deny.so</p>
<p class=3D"MsoNormal">auth&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;requi=
red&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; pam_faillock.so preauth audit silent deny=
=3D5</p>
<p class=3D"MsoNormal">auth&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [succ=
ess=3D1 default=3Dbad] pam_unix.so</p>
<p class=3D"MsoNormal">auth&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [defa=
ult=3Ddie] pam_faillock.so authfail audit deny=3D5</p>
<p class=3D"MsoNormal">auth&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; suffi=
cient&nbsp;&nbsp;&nbsp; pam_faillock.so authsucc audit deny=3D5</p>
<p class=3D"MsoNormal">account&nbsp; required&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
 pam_unix.so</p>
<p class=3D"MsoNormal">account&nbsp; sufficient&nbsp;&nbsp;&nbsp; pam_local=
user.so</p>
<p class=3D"MsoNormal">account&nbsp; sufficient&nbsp;&nbsp;&nbsp; pam_succe=
ed_if.so uid &lt; 500 quiet</p>
<p class=3D"MsoNormal">account&nbsp; required&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
 pam_permit.so</p>
<p class=3D"MsoNormal">&nbsp;</p>
<p class=3D"MsoNormal">After testing in our staging server, =93su - root=94=
 and =93sudo su =96 root=94 command are not working if &quot;auth required =
pam_deny.so&quot; is enable in /etc/pam.d/system-auth</p>
<p class=3D"MsoNormal">Would like to check if there are any areas that migh=
t be misconfigure.</p>
<p class=3D"MsoNormal">&nbsp;</p>
<p class=3D"MsoNormal">Thanks.</p>
<p class=3D"MsoNormal">&nbsp;</p>
<p class=3D"MsoNormal">Regards, </p>
<p class=3D"MsoNormal">Keng Lim</p>
<p class=3D"MsoNormal">&nbsp;</p>
</div>
<br>
<br>
</div>
<style><!--@font-face	{font-family:Latha}@font-face	{font-family:"Cambria M=
ath"}@font-face	{font-family:DengXian}@font-face	{font-family:Calibri}@font=
-face	{}p.MsoNormal, li.MsoNormal, div.MsoNormal	{margin:0in;	margin-bottom=
:.0001pt;	font-size:11.0pt;	font-family:"Calibri",sans-serif}a:link, span.M=
soHyperlink	{color:#0563C1;	text-decoration:underline}a:visited, span.MsoHy=
perlinkFollowed	{color:#954F72;	text-decoration:underline}span.EmailStyle17=
	{font-family:"Calibri",sans-serif;	color:windowtext}.MsoChpDefault	{}@page=
 WordSection1	{margin:1.0in 1.0in 1.0in 1.0in}div.WordSection1	{}--></style=
></div>
</div>
</body>
</html>

--_000_HK2PR01MB0947CA2C3409C5FA5040FA4F96800HK2PR01MB0947apcp_--


--===============1438182630203890637==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Pam-list mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/pam-list
--===============1438182630203890637==--