> -----Original Message-----
> From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On
> Behalf Of Gerrard Geldenhuis
> Sent: 14 September 2010 16:28
> To: centos at centos.org
> Subject: [CentOS] cron breaking when enabling ldap
>
> Hi
> When I enable a box to do authentication using LDAP it breaks cron for
> users like jboss.
>
> I get the following in /var/log/secure
> Sep 14 15:25:01 exoipatest01 crond[7214]: pam_access(crond:account):
> access denied for user `jboss' from `cron'
>
> I have the following in /etc/ldap.conf
> nss_initgroups_ignoreusers
> root,ldap,named,avahi,haldaemon,dbus,tomcat,radiusd,news,mailman,nscd,j
> boss
>
> /etc/pam.d/crond
> auth sufficient pam_env.so
> auth required pam_rootok.so
> auth include system-auth
> account required pam_access.so
> account include system-auth
> session required pam_loginuid.so
> session include system-auth
>
> /etc/pam.d/system-auth-ac
> #%PAM-1.0
> # This file is auto-generated.
> # User changes will be destroyed the next time authconfig is run.
> auth required pam_env.so
> auth sufficient pam_unix.so nullok try_first_pass
> auth requisite pam_succeed_if.so uid >= 500 quiet
> auth sufficient pam_ldap.so use_first_pass
> auth required pam_deny.so
>
> account required pam_access.so
> account required pam_unix.so broken_shadow
> account sufficient pam_localuser.so
> account sufficient pam_succeed_if.so uid < 500 quiet
> account [default=bad success=ok user_unknown=ignore] pam_ldap.so
> account required pam_permit.so
>
> password requisite pam_cracklib.so type= retry=3 difok=3
> minlen=8 dcredit=-1 ocredit=-1 ucredit=-1 lcredit=0
> password sufficient pam_unix.so md5 shadow nullok try_first_pass
> use_authtok
> password sufficient pam_ldap.so use_authtok
> password required pam_deny.so
>
> session optional pam_keyinit.so revoke
> session required pam_limits.so
> session optional pam_mkhomedir.so
> session [success=1 default=ignore] pam_succeed_if.so debug service
> in crond quiet use_uid
> session required pam_unix.so
> session optional pam_ldap.so
>
> I have added
> + : jboss : cron
>
> to /etc/security/access.conf which fixes the problem. However I am not
> sure that it is the "correct" fix.
>
> I would have thought that the string in /etc/ldap.conf
> nss_initgroups_ignoreusers would prevent this error unless I am
> confused about the pam ordering and sequence of how authentication
> happens.
>
> The cron job executes fine without LDAP enabled.
>
> Can anyone shed any more light on this error and a possible fix? I am
> using CentOS 5.5 fully updated.
>
> Best Regards
>
I have been stupid about this, I realized that I add a - : ALL : ALL when I
enable ldap which is not on a box without ldap. Adding this on a box without
ldap creates the same error. My fix is thus the correct fix.
Regards
________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from
MessageLabs to scan all Incoming and Outgoing mail for viruses.
________________________________________________________________________