We are using CentOS 6.5. We have a perl script for our automation testing. One of the script login to the user as non-root user and test "su -" command. This test case passes most of the times but fails in few instances.

Error message in /var/log/secure:

localhost su: pam_unix(su-l:auth): authentication failure; logname=test_user uid=500 euid=0 tty=pts/0 ruser=test_user rhost=  user=root

"test_user" is a non-root user.

So for debugging purpose we want to find whether the script issues the correct password or because of any buffer issues some additional characters are sent by the script.

Is there a configuration so that we can make the PAM modules to log the user entered password?

Following is the configuration of /etc/pam.d/su

auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth           required        pam_wheel.so use_uid
auth            include         system-auth
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         include         system-auth
session         optional        pam_xauth.so

Following is the configuration in /etc/pam.d/system-auth

auth    required        pam_env.so
auth    sufficient      pam_unix.so
auth    sufficient      pam_ldap.so try_first_pass
auth    required        pam_deny.so
account sufficient      pam_succeed_if.so uid < 100 quiet
account sufficient      pam_unix.so
account sufficient      pam_ldap.so
account required        pam_permit.so
password        requisite       pam_cracklib.so retry=3
password        sufficient      pam_unix.so use_authtok
password        sufficient      pam_ldap.so use_authtok
password        required        pam_deny.so
session required        pam_limits.so
session optional        pam_unix.so
session optional        pam_ldap.so
session required        pam_mkhomedir.so

Could someone give some pointers for me to debug this issue. I also tried adding debug and warn option to pam_unix.so in the system-auth file, still I am not getting additional log in /var/log/secure if there are authentication failures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.