I've written a web service in PHP5 using ext/SOAP and I've forged a basic
PAM module from web snippets I've found around the web and everythng
appears to work at a glance but in practice I am having a problem.
I'm trying to use the sshd application config in /etc/pam.d/sshd to test
my module but can I get it to authenticate? can I buggery!
The code where I send my PAM_SUCCESS is here:
/* now we have parsed the entire document we can return the PAM result */
if (soapResult == 1) {
authres = PAM_SUCCESS;
syslog(LOG_INFO, "User %s will be authenticated with password %s",
user, password);
return PAM_SUCCESS;
} else {
authres = PAM_AUTH_ERR;
syslog(LOG_INFO, "User %s failed to authenticate.", user);
return PAM_AUTH_ERR;
}
This works. Or at least I get the syslog entry showing both my username
and password as typed on the console and ssh clients request. You would
think that this would be all that was required no?
However, in my syslog I get:
Jul 3 16:30:12 caywdev pam_virtua_soap[20490]: User S10523 will be
authenticated with password MyPassword
Jul 3 16:30:14 caywdev sshd[20488]: error: PAM: Authentication failure
for S10523 from virtualfedora3.llgc.org.uk
my sshd config is set as follows:
# Change to no to disable s/key passwords
ChallengeResponseAuthentication yes
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication mechanism.
# Depending on your PAM configuration, this may bypass the setting of
# PasswordAuthentication, PermitEmptyPasswords, and
# "PermitRootLogin without-password". If you just want the PAM account and
# session checks to run without PAM authentication, then enable this but set
# ChallengeResponseAuthentication=no
#UsePAM no
UsePAM yes
Perhaps SSHD is not the best way to test this. Can anyone either solve my
sshd problem or provide an alternative method of testing my PAM module?
Oh and my /etc/pam.d/sshd looks like this:
#%PAM-1.0
auth required pam_stack.so service=system-auth
auth required pam_nologin.so
auth sufficient pam_virtua_soap.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth
session required pam_loginuid.so
Any help would be much appreciated.
--
Dan Field <dof@xxxxxxxxxxx> Tel. +44 1970 632 582
Datblygwr Systemau Systems Developer
Llyfrgell Genedlaethol Cymru National Library of Wales
_______________________________________________
Pam-list mailing list
Pam-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/pam-list
