On Fri, 2009-06-05 at 11:09 -0400, Stephen Smalley wrote: > On Fri, 2009-06-05 at 08:09 -0700, Vadym Chepkov wrote: > > --- On Fri, 6/5/09, Stephen Smalley <sds@xxxxxxxxxxxxx> wrote: > > > > > Found this thread: > > > http://www.mail-archive.com/samba@xxxxxxxxxxxxxxx/msg15640.html > > > > > > Can you configure winbind with use default domain=yes? > > > > > > > I do have have such setup. Both type of users are affected: local and "winbind" > > Can you append "debug" to the arguments to the latter instance of > pam_selinux.so, e.g.: > session required pam_selinux.so open env_params debug > > And then login again via ssh and look in /var/log/secure? Hmmm...btw, I notice that order of entries has changed in /etc/pam.d in F11 from F10, with the: session include system-auth line at the end of /etc/pam.d/sshd rather than between the two pam_selinux instances. So maybe the problem is that when you upgraded, it didn't replace your pam config due to your local configuration of winbind, and thus you didn't get that ordering change. I know that they reworked the way sshd interacts with pam_selinux. -- Stephen Smalley National Security Agency -- fedora-selinux-list mailing list fedora-selinux-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-selinux-list
