* [Comm] Настройка PAM. SSHD авторизация в winbind
@ 2008-03-04 11:54 Дмитрий
0 siblings, 0 replies; only message in thread
From: Дмитрий @ 2008-03-04 11:54 UTC (permalink / raw)
To: ALT Linux Community general discussions
Настроил авторизацию для всех приложений через winbind всё работает
кроме sshd.
# cat /etc/pam.d/sshd
#%PAM-1.0
auth required pam_userpass.so
auth include system-auth-winbind
auth required pam_nologin.so
account include system-auth-winbind
password include system-auth-winbind
session include system-auth-winbind
# cat /etc/pam.d/system-auth-winbind
#%PAM-1.0
#auth required pam_securetty.so
auth required pam_nologin.so
auth sufficient pam_winbind.so
auth include system-auth-use_first_pass
account sufficient pam_winbind.so
account include system-auth
password sufficient pam_winbind.so
password include system-auth
# We use pam_mkhomedir to create home dirs for incoming domain users
# Note used umask, it will result in rwxr-x--x access rights
session required pam_mkhomedir.so skel=/etc/skel/ umask=0026
session include system-auth
Вот лог /var/log/auth/all
Mar 4 16:05:54 xx sshd[8402]: pam_winbind(sshd:auth): getting password
(0x00000000)
Mar 4 16:05:54 xx sshd[8402]: pam_winbind(sshd:auth): Could not
retrieve user's password
Mar 4 16:05:55 xx sshd[8402]: Failed password for guest from
xxx.xxx.xxx.xxx port 55035 ssh2
Mar 4 16:05:55 xx sshd[8402]: Excess permission or bad ownership on
file /var/log/btmp
Mar 4 16:05:58 xx sshd[8402]: Failed password for guest from
xxx.xxx.xxx.xxx port 55035 ssh2
Mar 4 16:05:58 xx sshd[8402]: Excess permission or bad ownership on
file /var/log/btmp
Mar 4 16:06:05 xx sshd[8402]: Failed password for guest from
xxx.xxx.xxx.xxx port 55035 ssh2
Mar 4 16:06:05 xx sshd[8402]: Excess permission or bad ownership on
file /var/log/btmp
Mar 4 16:06:05 xx sshd[8405]: Connection closed by xxx.xxx.xxx.xxx
Mar 4 16:07:55 xx sshd[8417]: PAM unable to
dlopen(/lib64/security/pam_krb5.so)
Mar 4 16:07:55 xx sshd[8417]: PAM [error: /lib64/security/pam_krb5.so:
cannot open shared object file: No such file or directory]
Настроил аналогичным образом через Керберос и всё работает. В чём проблема?
# cat /etc/pam.d/sshd
#%PAM-1.0
auth required pam_userpass.so
auth include system-auth-krb5
auth required pam_nologin.so
account include system-auth-krb5
password include system-auth-krb5
session include system-auth-krb5
# cat /etc/pam.d/system-auth-krb5
#%PAM-1.0
auth sufficient pam_krb5.so
auth include system-auth-use_first_pass
account sufficient pam_krb5.so
account include system-auth
password sufficient pam_krb5.so
password include system-auth
### We use pam_mkhomedir to create home dirs for incoming domain users
### Note used umask, it will result in rwxr-x--x access rights
session required pam_mkhomedir.so skel=/etc/skel/ umask=0026
session include system-auth
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2008-03-04 11:54 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2008-03-04 11:54 [Comm] Настройка PAM. SSHD авторизация в winbind Дмитрий
ALT Linux Community general discussions
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/community/0 community/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 community community/ http://lore.altlinux.org/community \
mandrake-russian@linuxteam.iplabs.ru community@lists.altlinux.org community@lists.altlinux.ru community@lists.altlinux.com
public-inbox-index community
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.community
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git