search for: pam_selinux

With a recent update of CentOS4, su's behavior has changed, in that after prompting for password, also prompts for (selinux?) context. I'm seeing something like: $ su Password: Your default context is root:system_r:unconfined_t. Do you want to choose a different one? [n] kde's kdesu barfs on this second prompt. Any way to disable this second prompt? -- Rex

I have a couple of workstations that are perfect candidates for Linux at a client's location. The only think i am shaky on is getting CentOS 4.4 to integrate into the AD domain. Any tips links would be highly appreciated. -- My "Foundation" verse: Isa 54:17 No weapon that is formed against thee shall prosper; and every tongue that shall rise against thee in judgment thou

...uire. pam.d login #%PAM-1.0 auth required pam_securetty.so auth required pam_stack.so service=system-auth auth required pam_nologin.so account sufficient pam_winbind.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_stack.so service=system-auth session optional pam_console.so # pam_selinux.so open should be the last session rule session required pam_selinux.so multiple open pam.d system-auth #%PAM...

...ory, the configuration looks like this: # cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_sepermit.so auth include password-auth account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params...

...ory, the configuration looks like this: # cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_sepermit.so auth include password-auth account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params...

...#################################################### auth required pam_securetty.so auth required pam_stack.so service=system-auth auth required pam_nologin.so *auth sufficient pam_ldap.so* account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_stack.so service=system-auth session optional pam_console.so # pam_selinux.so open should be the last session rule session required pam_selinux.so multiple open ###############################...

...optional pam_xauth.so # cat /etc/pam.d/login #%PAM-1.0 auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so auth include system-auth account required pam_nologin.so account include system-auth password include system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session include system-auth session required pam_loginuid.so session optional pam_console.so # pam_selinux.so open should only be followed by sessions to be executed in the user context sess...

...skel=/etc/skel umask=0022 session required /lib/security/$ISA/pam_winbind.so /etc/pam.d/sshd: #%PAM-1.0 auth required pam_sepermit.so auth include password-auth account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional...

...required pam_sepermit.so auth substack password-auth auth include postlogin auth include system-auth auth sufficient pam_winbind.so account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional...

...o=XXXX /etc/pam.d/sshd: ------------------------------ #%PAM-1.0 auth required pam_sepermit.so auth substack password-auth auth include postlogin account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional...

...================== /etc/pam.d/login #%PAM-1.0 auth required pam_securetty.so auth required pam_stack.so service=system-auth auth required pam_nologin.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_stack.so service=system-auth session optional pam_console.so session required pam_mkhomedir.so skel=/etc/skel/ umask=0077 # pam_selinux.so open should be the last session...

...m_unix.so use_first_pass auth required pam_stack.so service=system-auth auth required pam_nologin.so account sufficient pam_winbind.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_stack.so service=system-auth session optional pam_console.so # pam_selinux.so open should be the last session rule session required pam_se...

I have a laptop with fedora core 3 installed. I have an NT domain that I would like to use for all authentication (Linux and Windows). As a test I decided to focus on ssh authentication. I have completed the following: Created the smb.conf: [global] workgroup = DOMAIN_NAME server string = Linux Workstation log file = /var/log/samba/%m.log max log size = 50 security = domain

...uired pam_stack.so service=system-auth ##### account sufficient /lib/security/pam_winbind.so account sufficient /lib/security/pam_unix.so ##### password required pam_stack.so service=system-auth #### password required /lib/security/pam_unix.so nullok obscure min=4 max=50 md5 # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_stack.so service=system-auth session optional pam_console.so # pam_selinux.so open should be the last session rule session required pam_selinux.so multiple open ######## session re...

Thanks a lot for looking over the config. I am at the topic "user data is available" id <username> and getent passwd and ldapsearch -x -b "ou=XXX,o=YYY" uid=<username> give the correct results ldapsearch gives also the correct host attribute i have set in the ldap server. Regarding the manpage of sssd.conf the lines access_provider = ldap ldap_access_order =

...auth contain, currently? /etc/pam.d/sshd: ---------------- #%PAM-1.0 auth required pam_sepermit.so auth substack password-auth auth include postlogin account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session optional...

...pam_unix.so use_first_pass likeauth nullok auth required pam_deny.so auth required pam_nologin.so account sufficient pam_winbind.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth session required pam_selinux.so close session required pam_mkhomedir.so skel=/etc/skel umask=0077 session required pam_stack.so service=system-auth session required pam_loginuid.so session optional pam_timestamp.so session optional pam_console.so session required pam_selinux.so multipl...

Hai Rowland, Thanks for the reply. Ok so we suspect and buggie pam module The pam.d/ssh is the default @include common-auth account required pam_nologin.so @include common-account session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close session required pam_loginuid.so session optional pam_keyinit.so force revoke @include common-session session optional pam_motd.so motd=/run/motd.dynamic session optional pam_motd.so noupdate session required pam_limits.so session required pam_env...

...obtain only the account present in /etc/passwd file and none of those included in ldap. /etc/pam.conf is empty # /etc/pam.d/samba @include common-auth @include common-account @include common-session # etc/pam.d/login auth requisite pam_securetty.so auth requisite pam_nologin.so session required pam_selinux.so close session required pam_env.so readenv=1 session required pam_env.so readenv=1 envfile=/etc/default/locale @include common-auth auth optional pam_group.so session required pam_limits.so session optional pam_lastlog.so session optional pam_motd.so session optional pam_mail.so standard @include...

Hai.   Config. Debian Stretch, samba 4.7.7. member server AD backend. Network setup like in the howtos here. : https://github.com/thctlo/samba4/tree/master/howtos      Today i discovered that somehow a disabled user was able to login after a few retries.   I run a SSH/SFTP server for data exchange with the customer of the company here.   The SSH/SFTP server is restricted by groups, this