Need example of working PAM.CONF file that enables ssh login using winbind and AD

"Bahto, Richard" <[email protected]>
Newsgroups gmane.os.solaris.managers
Message-ID <E7F19C9CF8C9D8498A2184FB3EA3FF46266082AB@msg21usa.usa.glb.tru.com> 
I am looking for help stacking the PAM.CONF file correctly as to allow me to
login into my system using ssh.

 

I believe I have successfully
connected to the windows DC as I am able to execute wbinfo commands and I am
getting back to appropriate output so I believe that at least that much is
correct. I have joined the domain and received a message stating that was
successful.

 

The pam.conf that I have tried and been unsuccessful
follows.  I have also tried using sufficient in place of binding with no
success. 

#ident  "@(#)pam.conf   1.31    07/12/07 SMI"

#

# Copyright
2007 Sun Microsystems, Inc.  All rights reserved.

# Use is subject to
license terms.

#

# PAM configuration

#

# Unless explicitly
defined, all services use the modules

# defined in the "other" section.
#

# Modules are defined with relative pathnames, i.e., they are

#
relative to /usr/lib/security/$ISA. Absolute path names, as

# present in
this file in previous releases are still acceptable.

#

# Authentication
management

#

# login service (explicit because of pam_dial_auth)

#
login   auth requisite          pam_authtok_get.so.1

login   auth binding
pam_winbind.so.1 try_first_pass

login   auth required
pam_dhkeys.so.1

#ssh-kbdint      auth sufficient
/usr/lib/nss_winbind.so try_first_pass

#login   account sufficient
/usr/lib/nss_winbind.so try_first_pass

#login   session sufficient
/usr/lib/nss_winbind.so try_first_pass

login   auth required
pam_unix_cred.so.1

login   auth required           pam_unix_auth.so.1
login   auth required           pam_dial_auth.so.1

#

# rlogin service
(explicit because of pam_rhost_auth)

#

# rlogin        auth sufficient
pam_rhosts_auth.so.1

rlogin  auth requisite          pam_authtok_get.so.1
rlogin  auth required           pam_dhkeys.so.1

rlogin  auth required
pam_unix_cred.so.1

rlogin  auth required           pam_unix_auth.so.1

#
# Kerberized rlogin service

#

krlogin auth required
pam_unix_cred.so.1

krlogin auth required           pam_krb5.so.1

#

#
rsh service (explicit because of pam_rhost_auth,

# and pam_unix_auth for
meaningful pam_setcred)

#

# rsh   auth sufficient
pam_rhosts_auth.so.1

rsh     auth required           pam_unix_cred.so.1
#

# Kerberized rsh service

#

krsh    auth required
pam_unix_cred.so.1

krsh    auth required           pam_krb5.so.1

#

#
Kerberized telnet service

#

ktelnet auth required
pam_unix_cred.so.1

ktelnet auth required           pam_krb5.so.1

#

#
PPP service (explicit because of pam_dial_auth)

#

ppp     auth requisite
pam_authtok_get.so.1

ppp     auth required           pam_dhkeys.so.1

ppp
auth required           pam_unix_cred.so.1

ppp     auth required
pam_unix_auth.so.1

ppp     auth required           pam_dial_auth.so.1

#
# Default definitions for Authentication management

# Used when service
name is not explicitly mentioned for authentication

#

other   auth
requisite          pam_authtok_get.so.1

other auth binding pam_winbind.so.1
try_first_pass debug

other   auth required           pam_dhkeys.so.1
other   auth required           pam_unix_cred.so.1

other   auth required
pam_unix_auth.so.1

#

# passwd command (explicit because of a different
authentication module)

#

passwd auth required pam_winbind.so.1

passwd
auth required           pam_passwd_auth.so.1

#

# cron service (explicit
because of non-usage of pam_roles.so.1)

#

cron    account required
pam_unix_account.so.1

#

# Default definition for Account management

#
Used when service name is not explicitly mentioned for account management

#
other   account requisite       pam_roles.so.1

other   account required
pam_unix_account.so.1

other account sufficient pam_winbind.so.1

#

#
Default definition for Session management

# Used when service name is not
explicitly mentioned for session management

#

other session required
pam_winbind.so.1 try_first_pass

other   session required
pam_unix_session.so.1

#

# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
#

other   password required       pam_dhkeys.so.1

other   password
requisite      pam_authtok_get.so.1

other   password requisite
pam_authtok_check.so.1

other   password required
pam_authtok_store.so.1

other password sufficient pam_winbind.so.1
try_first_pass

#

# Support for Kerberos V5 authentication and example
configurations can

# be found in the pam_krb5(5) man page under the
"EXAMPLES" section.

#

 

 

 

As you might have notice I have
also tried using the service name ssh-kbdint as I thought this was needed when
the system responded with a password prompt.

 

I'm not sure about much
here as this is my 1st attempt at getting this to work so I would appreciate
any suggestions anyone has to offer. I can supply any additional info as
required I just don't have idea what else might be needed.  This is the output
of the pam.log file

 

 

Dec 14 15:26:37    sshd[1775]: [ID 800047
auth.notice] Failed none for ldapbahtor from 10.3.80.3 port 4121 ssh2

Dec
14 15:26:38    sshd[1775]: [ID 800047 auth.notice] Failed publickey for
ldapbahtor from 10.3.80.3 port 4121 ssh2

Dec 14 15:26:38    sshd[1775]: [ID
800047 auth.notice] Failed none for ldapbahtor from 10.3.80.3 port 4121 ssh2
Dec 14 15:26:38    sshd[1775]: [ID 178370 auth.debug] PAM[1775]:
pam_start(sshd-kbdint,ldapbahtor,752b8:92678) - debug = 1

Dec 14 15:26:38
sshd[1775]: [ID 378129 auth.debug] PAM[1775]: pam_set_item(92678:service)
Dec 14 15:26:38    sshd[1775]: [ID 378129 auth.debug] PAM[1775]:
pam_set_item(92678:user)

Dec 14 15:26:38    sshd[1775]: [ID 378129
auth.debug] PAM[1775]: pam_set_item(92678:conv)

Dec 14 15:26:38
sshd[1775]: [ID 378129 auth.debug] PAM[1775]: pam_set_item(92678:rhost)

Dec
14 15:26:38    sshd[1775]: [ID 378129 auth.debug] PAM[1775]:
pam_set_item(92678:tty)

Dec 14 15:26:38    sshd[1775]: [ID 277351
auth.debug] PAM[1775]: pam_authenticate(92678, 0)

Dec 14 15:26:38
sshd[1775]: [ID 824104 auth.debug] PAM[1775]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_winbind.so.1

Dec 14 15:26:38
sshd[1775]: [ID 946359 auth.debug] PAM[1775]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:26:38    sshd[1775]: [ID 824104
auth.debug] PAM[1775]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_authtok_get.so.1

Dec 14 15:26:38
sshd[1775]: [ID 946359 auth.debug] PAM[1775]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:26:38    sshd[1775]: [ID 824104
auth.debug] PAM[1775]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_dhkeys.so.1

Dec 14 15:26:38
sshd[1775]: [ID 946359 auth.debug] PAM[1775]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:26:38    sshd[1775]: [ID 824104
auth.debug] PAM[1775]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_unix_cred.so.1

Dec 14 15:26:38
sshd[1775]: [ID 946359 auth.debug] PAM[1775]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:26:38    sshd[1775]: [ID 824104
auth.debug] PAM[1775]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_unix_auth.so.1

Dec 14 15:26:38
sshd[1775]: [ID 946359 auth.debug] PAM[1775]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:26:38    sshd[1775]: [ID 380265
auth.debug] pam_winbind(sshd-kbdint): [pamh: 0x00092678] ENTER:
pam_sm_authenticate (flags: 0x0000)

Dec 14 15:26:38    sshd[1775]: [ID
335567 auth.debug] PAM[1775]: pam_get_user(92678, ff278a6c, NULL)

Dec 14
15:26:38    sshd[1775]: [ID 700344 auth.debug] pam_winbind(sshd-kbdint):
getting password (0x00000009)

Dec 14 15:26:42    sshd[1775]: [ID 378129
auth.debug] PAM[1775]: pam_set_item(92678:authtok)

Dec 14 15:26:42
sshd[1775]: [ID 682265 auth.info] pam_winbind(sshd-kbdint): Verify user
'ldapbahtor'

Dec 14 15:26:43    sshd[1775]: [ID 979653 auth.error]
pam_winbind(sshd-kbdint): request failed: Named pipe dicconnected, PAM error
was System error (4), NT error was NT_STATUS_PIPE_DISCONNECTED _----- I see
this quite a bit

Dec 14 15:26:43    sshd[1775]: [ID 947627 auth.error]
pam_winbind(sshd-kbdint): internal module error (retval = 4, user =
'ldapbahtor')

Dec 14 15:26:43    sshd[1775]: [ID 785508 auth.debug]
pam_winbind(sshd-kbdint): [pamh: 0x00092678] LEAVE: pam_sm_authenticate
returning 4

Dec 14 15:26:43    sshd[1775]: [ID 223374 auth.debug]
PAM[1775]: pam_authenticate(92678, 0): error System error

Dec 14 15:26:43
sshd[1775]: [ID 335567 auth.debug] PAM[1775]: pam_get_user(92678, 0, NULL)
Dec 14 15:26:43    sshd[1775]: [ID 223374 auth.debug] PAM[1775]:
pam_authenticate(92678, 0): error No account present for user

Dec 14
15:26:43    sshd[1775]: [ID 219349 auth.debug] pam_unix_auth: user ldapbahtor
not found

Dec 14 15:26:43    sshd[1775]: [ID 223374 auth.debug] PAM[1775]:
pam_authenticate(92678, 0): error No account present for user

Dec 14
15:26:43    sshd[1775]: [ID 378129 auth.debug] PAM[1775]:
pam_set_item(92678:authtok)

Dec 14 15:26:43    sshd[1775]: [ID 800047
auth.info] Keyboard-interactive (PAM) userauth failed[13] while
authenticating: No account present for user

Dec 14 15:26:43    sshd[1775]:
[ID 800047 auth.notice] Failed keyboard-interactive for ldapbahtor from
10.3.80.3 port 4121 ssh2

Dec 14 15:26:43    sshd[1775]: [ID 378129
auth.debug] PAM[1775]: pam_set_item(92678:conv)

Dec 14 15:26:43
sshd[1775]: [ID 995591 auth.debug] PAM[1775]: pam_end(92678): status = No
account present for user

Dec 14 15:26:43    sshd[1775]: [ID 178370
auth.debug] PAM[1775]: pam_start(sshd-kbdint,ldapbahtor,752b8:92678) - debug =
1

Dec 14 15:26:43    sshd[1775]: [ID 378129 auth.debug] PAM[1775]:
pam_set_item(92678:service)

Dec 14 15:26:43    sshd[1775]: [ID 378129
auth.debug] PAM[1775]: pam_set_item(92678:user)

Dec 14 15:26:43
sshd[1775]: [ID 378129 auth.debug] PAM[1775]: pam_set_item(92678:conv)

Dec
14 15:26:43    sshd[1775]: [ID 378129 auth.debug] PAM[1775]:
pam_set_item(92678:rhost)

Dec 14 15:26:43    sshd[1775]: [ID 378129
auth.debug] PAM[1775]: pam_set_item(92678:tty)

Dec 14 15:26:43
sshd[1775]: [ID 277351 auth.debug] PAM[1775]: pam_authenticate(92678, 0)
Dec 14 15:26:43    sshd[1775]: [ID 824104 auth.debug] PAM[1775]:
load_modules(92678, pam_sm_authenticate)=/usr/lib/security/pam_winbind.so.1
Dec 14 15:26:43    sshd[1775]: [ID 946359 auth.debug] PAM[1775]:
load_function: successful load of pam_sm_authenticate

Dec 14 15:26:43
sshd[1775]: [ID 824104 auth.debug] PAM[1775]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_authtok_get.so.1

Dec 14 15:26:43
sshd[1775]: [ID 946359 auth.debug] PAM[1775]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:26:43    sshd[1775]: [ID 824104
auth.debug] PAM[1775]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_dhkeys.so.1

Dec 14 15:26:43
sshd[1775]: [ID 946359 auth.debug] PAM[1775]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:26:43    sshd[1775]: [ID 824104
auth.debug] PAM[1775]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_unix_cred.so.1

Dec 14 15:26:43
sshd[1775]: [ID 946359 auth.debug] PAM[1775]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:26:43    sshd[1775]: [ID 824104
auth.debug] PAM[1775]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_unix_auth.so.1

Dec 14 15:26:43
sshd[1775]: [ID 946359 auth.debug] PAM[1775]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:26:43    sshd[1775]: [ID 380265
auth.debug] pam_winbind(sshd-kbdint): [pamh: 0x00092678] ENTER:
pam_sm_authenticate (flags: 0x0000)

Dec 14 15:26:43    sshd[1775]: [ID
335567 auth.debug] PAM[1775]: pam_get_user(92678, ff278a6c, NULL)

Dec 14
15:26:43    sshd[1775]: [ID 700344 auth.debug] pam_winbind(sshd-kbdint):
getting password (0x00000009)

Dec 14 15:26:53    sshd[1775]: [ID 800047
auth.info] Connection closed by 10.3.80.3

Dec 14 15:26:53    sshd[1775]:
[ID 378129 auth.debug] PAM[1775]: pam_set_item(92678:conv)

Dec 14 15:26:53
sshd[1775]: [ID 995591 auth.debug] PAM[1775]: pam_end(92678): status = General
PAM failure

Dec 14 15:27:58    sshd[476]: [ID 800047 auth.info] Received
signal 15; terminating.

Dec 14 15:27:59    sshd[1806]: [ID 800047
auth.info] Server listening on :: port 22.

Dec 14 15:28:10    sshd[1808]:
[ID 800047 auth.notice] Failed none for ldapbahtor from 10.3.80.3 port 4124
ssh2

Dec 14 15:28:10    sshd[1808]: [ID 800047 auth.notice] Failed
publickey for ldapbahtor from 10.3.80.3 port 4124 ssh2

Dec 14 15:28:10
sshd[1808]: [ID 800047 auth.notice] Failed none for ldapbahtor from 10.3.80.3
port 4124 ssh2

Dec 14 15:28:10    sshd[1808]: [ID 338194 auth.debug]
PAM[1808]: pam_start(sshd-kbdint,ldapbahtor,752b8:92678) - debug = 1

Dec 14
15:28:10    sshd[1808]: [ID 207492 auth.debug] PAM[1808]:
pam_set_item(92678:service)

Dec 14 15:28:10    sshd[1808]: [ID 207492
auth.debug] PAM[1808]: pam_set_item(92678:user)

Dec 14 15:28:10
sshd[1808]: [ID 207492 auth.debug] PAM[1808]: pam_set_item(92678:conv)

Dec
14 15:28:10    sshd[1808]: [ID 207492 auth.debug] PAM[1808]:
pam_set_item(92678:rhost)

Dec 14 15:28:10    sshd[1808]: [ID 207492
auth.debug] PAM[1808]: pam_set_item(92678:tty)

Dec 14 15:28:10
sshd[1808]: [ID 473595 auth.debug] PAM[1808]: pam_authenticate(92678, 0)
Dec 14 15:28:10    sshd[1808]: [ID 922226 auth.debug] PAM[1808]:
load_modules(92678, pam_sm_authenticate)=/usr/lib/security/pam_winbind.so.1
Dec 14 15:28:10    sshd[1808]: [ID 674411 auth.debug] PAM[1808]:
load_function: successful load of pam_sm_authenticate

Dec 14 15:28:10
sshd[1808]: [ID 922226 auth.debug] PAM[1808]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_authtok_get.so.1

Dec 14 15:28:10
sshd[1808]: [ID 674411 auth.debug] PAM[1808]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:28:10    sshd[1808]: [ID 922226
auth.debug] PAM[1808]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_dhkeys.so.1

Dec 14 15:28:10
sshd[1808]: [ID 674411 auth.debug] PAM[1808]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:28:10    sshd[1808]: [ID 922226
auth.debug] PAM[1808]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_unix_cred.so.1

Dec 14 15:28:10
sshd[1808]: [ID 674411 auth.debug] PAM[1808]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:28:10    sshd[1808]: [ID 922226
auth.debug] PAM[1808]: load_modules(92678,
pam_sm_authenticate)=/usr/lib/security/pam_unix_auth.so.1

Dec 14 15:28:10
sshd[1808]: [ID 674411 auth.debug] PAM[1808]: load_function: successful load
of pam_sm_authenticate

Dec 14 15:28:10    sshd[1808]: [ID 380265
auth.debug] pam_winbind(sshd-kbdint): [pamh: 0x00092678] ENTER:
pam_sm_authenticate (flags: 0x0000)

Dec 14 15:28:10    sshd[1808]: [ID
993556 auth.debug] PAM[1808]: pam_get_user(92678, ff278a6c, NULL)

Dec 14
15:28:10    sshd[1808]: [ID 700344 auth.debug] pam_winbind(sshd-kbdint):
getting password (0x00000009)

Dec 14 15:28:14    sshd[1808]: [ID 207492
auth.debug] PAM[1808]: pam_set_item(92678:authtok)

Dec 14 15:28:14
sshd[1808]: [ID 682265 auth.info] pam_winbind(sshd-kbdint): Verify user
'ldapbahtor'

Dec 14 15:28:14    sshd[1808]: [ID 979653 auth.error]
pam_winbind(sshd-kbdint): request failed: Named pipe dicconnected, PAM error
was System error (4), NT error was NT_STATUS_PIPE_DISCONNECTED
Thanks in advance

Richard Bahto

 

...
=================================================================
This email
message is for the sole use of the intended recipient(s)
and may contain
confidential and privileged information. Any
unauthorized review, use,
disclosure or distribution is prohibited.
If you are not the intended
recipient, please contact the sender by
reply email and destroy all copies of
the original message. To
reply to our email administrator directly, send an
email to
[email protected]. 
Toys "R" Us, Inc.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.