8

in my Linux machine - red-hat

I successfully to login to different users as the following

su - userC
[machine@Linux ~]$ pwd
[machine@Linux ~]$ /Users/userC

but only in one user I get the following

su - UserA
Creating directory '/User/UserA'.
could not open session

please advice from where I get the message "could not open session"

what could be the problem ?

7
  • what is the output of getent passwd and are you using LDAP, flat files, or something else? It really looks like UserA's shell is set to /sbin/nologin
    – SailorCire
    Dec 2, 2014 at 17:50
  • 1
    Does that directory exist? Is the difference in case on /Users/userC and /Users/UserA a typo? Intentional? The problem? Dec 2, 2014 at 17:51
  • yes I already tried the getent passwd and the output is fine Dec 2, 2014 at 17:53
  • if I am using LDAP , not sure but the file /etc/openldap/ldap.conf exist in my machine so I guess yes Dec 2, 2014 at 17:59
  • but which file or app send the mesg - could not open session? Dec 2, 2014 at 18:03

9 Answers 9

9
root@hostname # su - oracle
could not open session

root@hostname # grep oracle.*nofile /etc/security/limits.conf
oracle          -       nofile          unlimited

set nofile in limits.conf to some number instead of unlimited:

root@hostname # vi /etc/security/limits.conf
root@hostname # grep oracle.*nofile /etc/security/limits.conf
oracle          -       nofile          65536
root@hostname # su - oracle
-bash-4.1$ id
uid=201(oracle) gid=5504(oinstall) groups=5504(oinstall),251(dba),5502(asmdba),5505(oper)
-bash-4.1$
1
  • On my system, the soft OS limit is: cat /proc/sys/fs/file-max # 512000 Which suggests you need the line oracle - nofile 512000 instead Mar 1, 2018 at 13:58
7

This is what worked for me, in my case su was working for some users. So, I checked the content of /etc/pam.d/su and it had the following two lines :

session include system-auth

session optional pam_xauth.so

I commented out the first one, restarted the session and it worked.

3
  • This worked for me! Jul 6, 2019 at 9:36
  • This worked, but any idea why this needs to be changed?
    – Justin
    Sep 9, 2019 at 19:39
  • 1
    ya, this also worked for me. But I'm truly curious about why this is happening. As an additional layer of the problem, this ONLY occured when I had nofile limits set in /etc/security/limits.conf for the user it was effecting -- if I removed EITHER the session include system-auth in pam.d/su OR the nofile limits in /etc/security/limits.conf the Su would start working again.
    – Mr.Budris
    Feb 26, 2020 at 19:34
5

commenting "session required pam_limits.so" in all files in "/etc/pam.d" solves

  • su: cannot open session: Permission denied
  • runuser: cannot open session: Permission denied

(OL7.7)

sed -i -r 's/^(session\s+required\s+pam_limits.so)/#\1/' /etc/pam.d/*
2
  • I encountered this problem while running Oracle Linux 8.5 in a Docker container, and this solved the problem for me. It's not clear to me whether there are any security implications for making this change, but, alas, I do not care given my specific use-case. So, thank you!!! Dec 15, 2021 at 15:14
  • Also worked for me with docker running Red Hat Enterprise Linux Server release 6.10 (Santiago). Thank you!!! Aug 16 at 12:35
3

If "nofile" is set to "unlimited" in /etc/security/limits.conf (or in files in limits.d) then the user cannot login.

3

Commenting out 'session include system-auth' worked for me.

env: docker oraclelinux:latest, after installing oracle-database-server-12cR2-preinstall.x86_64 package.

2

I was playing with docker and oraclelinux:7-slim, to install an Oracle Database. After installing oracle-database-preinstall-19c package, I stopped being able to su - into oracle account. Here some talk about "nofile unlimited" in limits.conf. I tried that and it didn't work. Commenting session include system-auth line in /etc/pam.d/su works.

However, before I installed the package, the configuration was all the same and I was able to do su - oracle. Even after installed the package, if I create a new user belonging to the same groups as oracle I can su into their account. So it had to be something that the package changed.

After some investigation I discovered that the packages installs oracle-database-preinstall-19c.conf in /etc/security/limits.d/ and that file has all the oracle limits configuration. Only when I commented the following line, was I able to su into oracle account:

oracle hard memlock 134217728

This sets the memlock to 128Gb.Tried to put smaller values without success. Only when I commented.

So now you know that this is the cause. But of course, if you comment session include system-auth line in /etc/pam.d/su it works too.

0

Make sure pam_limits.so line has tabs like this:

session^I^Irequired^Ipam_limits.so$

When this line is added, the tabs are important.

sed -i '$a session^I^Irequired^Ipam_limits.so' /etc/pam.d/su

If the tabs are missing, then you will see something like this:

[ azureadmin]# su - ALOGIN
Last login: Fri Jun 11 08:42:32 CDT 2021 on pts/0
su: cannot open session: Permission denied
0

I came across this same error. "sudo su -" did not work, nor did "su -", however "sudo -iu root" or "sudo /bin/bash" did "work" ("sudo /bin/bash" isn't quite doing the same thing, in terms of environment variables, so I feel a little dubious calling this a work around). The answer wasn't the "nofile" limit, nor was the answer the permissions on /etc/pam.d/system* files. The answer in my case was that /var/log/btmp was corrupted.

# cat /dev/null > /var/log/btmp
-1

Some times it happens to me with error "could not open session" and It works with just type

sudo bash

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.