0

I was doing some maintenance via root account over ssh after several months of inattention. I shutdown, after startup I can't log in to root account at tty or via ssh. Fortunately, sudo works to perform root actions through my user account. There's nothing special about the install. Its out-of-the-box, so to speak. root uses local authentication.

I first tried changing the root password. The password change was successful, because I was also able to authenticate against the root account with: authconfig --test, which asks for root password outside of sudo/su.

Reset permissions and owner/groups with rpm -a --setperms coreutils

PAM debug on pam_succeed_if.so. Here is the last borked session using pam debug flag:

Jul 27 18:29:18 mrwizard sshd[2054]: Server listening on 0.0.0.0 port 22.
Jul 27 18:29:18 mrwizard sshd[2054]: Server listening on :: port 22.
Jul 27 18:32:51 mrwizard login: pam_succeed_if(login:session): 'service' resolves to 'login'
Jul 27 18:32:51 mrwizard login: pam_succeed_if(login:session): requirement "service in crond" not met by user "root"
Jul 27 18:32:51 mrwizard login: pam_unix(login:session): session opened for user root by LOGIN(uid=0)
Jul 27 18:32:51 mrwizard login: ROOT LOGIN ON tty1
Jul 27 18:32:52 mrwizard login: pam_succeed_if(login:session): 'service' resolves to 'login'
Jul 27 18:32:52 mrwizard login: pam_succeed_if(login:session): requirement "service in crond" not met by user "root"
Jul 27 18:32:52 mrwizard login: pam_unix(login:session): session closed for user root
Jul 27 18:32:56 mrwizard login: pam_succeed_if(login:session): 'service' resolves to 'login'
Jul 27 18:32:56 mrwizard login: pam_succeed_if(login:session): requirement "service in crond" not met by user "root"

requirement "service in crond" seems normal TMI

// As requested:

Jul 27 18:29:27 mrwizard crond[2271]: (CRON) STARTUP (1.4.4)
Jul 27 18:29:27 mrwizard crond[2271]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 34% if used.)
Jul 27 18:29:27 mrwizard crond[2271]: (CRON) INFO (running with inotify support)
Jul 27 18:30:01 mrwizard CROND[2479]: (root) CMD (/usr/lib/sa/sa1 1 1)
Jul 27 18:40:01 mrwizard CROND[5021]: (root) CMD (/usr/lib/sa/sa1 1 1)
Jul 27 18:50:01 mrwizard CROND[7503]: (root) CMD (/usr/lib/sa/sa1 1 1)
Jul 27 19:00:01 mrwizard CROND[10985]: (root) CMD (/usr/lib/sa/sa1 1 1)
Jul 27 19:01:01 mrwizard CROND[11232]: (root) CMD (run-parts /etc/cron.hourly)
Jul 27 19:01:01 mrwizard run-parts(/etc/cron.hourly)[11232]: starting 0anacron
Jul 27 19:01:01 mrwizard run-parts(/etc/cron.hourly)[11241]: finished 0anacron
Jul 27 19:10:01 mrwizard CROND[13425]: (root) CMD (/usr/lib/sa/sa1 1 1)
Jul 27 19:20:01 mrwizard CROND[16899]: (root) CMD (/usr/lib/sa/sa1 1 1)
Jul 27 19:30:01 mrwizard CROND[19324]: (root) CMD (/usr/lib/sa/sa1 1 1)
Jul 27 19:40:01 mrwizard CROND[21719]: (root) CMD (/usr/lib/sa/sa1 1 1)
Jul 28 18:14:45 mrwizard crond[2317]: (CRON) STARTUP (1.4.4)
Jul 28 18:14:45 mrwizard crond[2317]: (CRON) INFO (RANDOM_DELAY will be scaled with factor 45% if used.)
Jul 28 18:14:45 mrwizard crond[2317]: (CRON) INFO (running with inotify support)

$ cat /etc/pam.d/crond 
# The PAM configuration file for the cron daemon
# No PAM authentication called, auth modules not needed
account    required   pam_access.so
account    include    password-auth
session    required   pam_loginuid.so
session    include    password-auth
auth       include    password-auth
  • Please post what you get with these commands: "# tail -f /var/log/cron" and "# cat /etc/pam.d/crond" – Jason Enochs Jul 28 '14 at 12:26
  • Following the suggestion, I notice the pam_access.so file references access.conf. Curiously, my version is completely commented out. And, to make my failure complete I don't have a backup to verify if it was ever used. Which then reminds me of a warning in pam.d/system-auth suggesting that file is auto-generated. So, my question, if there was a hiccup from my remote administration using root, could other files in pam.d have locked out root? – xtian Jul 28 '14 at 23:11
  • I walked through PAM module pages return values looking for requirement...not met by user without any success. – xtian Jul 29 '14 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.