2

I need to run a script whenever a user enters a password; the script should be able to reject that password, but shouldn't be sufficient.

I placed the script in /etc/pamunlockscript/pam_script_auth and added the following line at the end of /etc/pam.d/common-auth:

auth required pam_script.so dir=/etc/pamunlockscript.

According to man 7 pam-script,

All  the  scripts  will be passed several environment variables:
PAM_USER,  PAM_RUSER,   PAM_RHOST,   PAM_SERVICE,   PAM_AUTHTOK,
PAM_TTY,   and  PAM_TYPE  referring  to  the  module-type.

My test script is

#!/bin/sh
echo script: $PAM_AUTHTOK $PAM_USER

I expect every program that uses pam to echo script: (my password) mic whenever it verifies my password.

This works for the programs login and i3lock, but the script echoes script: for sudo.

Improve this question
7
  • Please provide at least the relevant part of your script.
    – John WH Smith
    Dec 15, 2014 at 12:03
  • The script is simply echo $PAM_USER $PAM_AUTHTOK.
    – mic_e
    Dec 15, 2014 at 14:36
  • Then where are you "attempting sudo"? Where do they get unset? Where's the problem if "your script prints the environment variables"?
    – John WH Smith
    Dec 15, 2014 at 14:43
  • I have clarified the question (I hope).
    – mic_e
    Dec 15, 2014 at 15:22
  • I was unable to reproduce your problem: everything works just fine when I try it on my machine. Could you provide the contents of your /etc/sudoers and /etc/pam.d/sudo files? Make sure there is no sensitive information in them before posting.
    – John WH Smith
    Dec 15, 2014 at 17:30

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .