I've reproduced this bug in versions openssh-3.7p1 and openssh-3.8p1
I've verfived that it works PERFECTLY in versions openssh-3.6p1 and
openssh-2.9p2
I have not tested any other versions.
The problem is sshd will not authenticate passwords off a NT4 domain using
winbind and pam.
Broken Debug output is:
debug1: PAM: initializing for "user"
debug1: PAM: setting PAM_RHOST to "user.domain.com"
Failed none for user from 192.168.1.21 port 3971 ssh2
Failed none for user from 192.168.1.21 port 3971 ssh2
debug1: userauth-request for user user service ssh-connection method
password
debug1: attempt 1 failures 1
Failed password for user from 192.168.1.21 port 3971 ssh2
Failed password for user from 192.168.1.21 port 3971 ssh2
Working Debug output is:
debug1: Starting up PAM with username "user"
debug1: PAM setting rhost to "user.domain.com"
Failed none for user from 192.168.1.21 port 3948 ssh2
Failed none for user from 192.168.1.21 port 3948 ssh2
debug1: userauth-request for user user service ssh-connection method
password
debug1: attempt 1 failures 1
debug1: PAM Password authentication accepted for user "user"
Accepted password for user from 192.168.1.21 port 3948 ssh2
Accepted password for user from 192.168.1.21 port 3948 ssh2
debug1: monitor_child_preauth: user has been authenticated by privileged
process
debug1: Entering interactive session for SSH2.
To reproduce:
Build openssh with --with-pam option
Install samba
Your smb.conf should be running in:
security = domain
And your /etc/pam.d/sshd should look like this:
# auth
auth sufficient pam_winbind.so
auth sufficient pam_nologin.so no_warn
auth sufficient pam_opie.so no_warn
no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
auth sufficient pam_unix.so no_warn
try_first_pass
account sufficient pam_winbind.so
account required pam_unix.so
session required pam_permit.so
password required pam_unix.so no_warn try_first_pass
And just attempt to login using a domain user/pass
I'm using an older version of sshd now, but I thought I would report the
problem because I spent many hours finding it.
I'm also not on this list so please reply to me with questions.
Thank you!
_________________________________________________________________
Is your PC infected? Get a FREE online computer virus scan from McAfee?
Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963