1

I set up a fresh Ubuntu 14.04 LTS VM on VirtualBox and did an upgrade, so now I'm sitting at 14.04.2. Our office environment is NIS+NFS. I set up autofs and NIS, and confirmed that I can log in as a local user, sudo bash to get root, su - nis_user to become a NIS user, and have the correct identity and see my files.

I also discovered the pam_unix.so broken_shadow detail in PAM's "common-account" file, so after adding that now my NIS users can log in via SSH and that's good. I also added a list of NIS users to /etc/sudoers.d/local-sudoers, each line of the form

<username> ALL=(ALL:ALL) ALL

But I can't figure out why NIS users can't log in on the VM's console, nor can they run sudo. I'm comparing this VM's configuration to other Ubuntu hosts (14.04.1 and 12.04) and don't see anything particularly illuminating. Can you help me figure out what's going on and how to fix it?

/etc/pam.d/common-account

account [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so broken_shadow audit
account requisite                       pam_deny.so
account required                        pam_permit.so

/etc/pam.d/common-auth

auth    [success=1 default=ignore]      pam_unix.so nullok_secure audit
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
auth    optional                        pam_cap.so 

/etc/nsswitch.conf

passwd:        files nis
group:         files nis
shadow:        files nis
hosts:          files dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis
automount: files nis
aliases: files nis nisplus

/var/log/auth.log after local user ("administrator") successfully logs in on console

Jul 23 10:46:34 ubuntu login[1925]: pam_unix(login:session): session opened for user administrator by administrator(uid=0)

/var/log/auth.log after local user ("administrator") successfully logs in via SSH

Jul 23 10:48:42 ubuntu sshd[2161]: Accepted password for administrator from 192.168.56.1 port 46188 ssh2
Jul 23 10:48:42 ubuntu sshd[2161]: pam_unix(sshd:session): session opened for user administrator by (uid=0)

/var/log/auth.log after local user ("administrator") successfully does sudo

Jul 23 10:51:22 ubuntu sudo: administrator : TTY=pts/0 ; PWD=/local/home/administrator ; USER=root ; COMMAND=/bin/bash
Jul 23 10:51:22 ubuntu sudo: pam_unix(sudo:session): session opened for user root by administrator(uid=0)

/var/log/auth.log after NIS user tries console login and fails

Jul 23 11:02:47 ubuntu login[2259]: pam_unix(login:auth): check pass; user (rsd3) unknown
Jul 23 11:02:47 ubuntu login[2259]: pam_unix(login:auth): authentication failure; logname=administrator uid=0 euid=0 tty=/dev/tty2 ruser= rhost=  user=rsd3
Jul 23 11:02:50 ubuntu login[2259]: FAILED LOGIN (1) on '/dev/tty2' FOR 'rsd3', Authentication failure

/var/log/auth.log after NIS user successfully logs in via SSH

Jul 23 11:04:57 ubuntu sshd[2273]: Accepted publickey for rsd3 from 192.168.56.1 port 46217 ssh2: DSA 0f:04:dd:56:42:1d:da:4f:29:48:4b:f0:e6:fe:c6:a8
Jul 23 11:04:57 ubuntu sshd[2273]: pam_unix(sshd:session): session opened for user rsd3 by (uid=0)

/var/log/auth.log after NIS user tries sudo and fails

Jul 23 11:07:00 ubuntu sudo: pam_unix(sudo:auth): check pass; user (rsd3) unknown
Jul 23 11:07:00 ubuntu sudo: pam_unix(sudo:auth): authentication failure; logname=rsd3 uid=10002 euid=0 tty=/dev/pts/0 ruser=rsd3 rhost=  user=rsd3

## at this point I hit ^C to cancel sudo attempt ##

Jul 23 11:07:19 ubuntu sudo: pam_unix(sudo:auth): conversation failed
Jul 23 11:07:19 ubuntu sudo: pam_unix(sudo:auth): unable to obtain a password
Jul 23 11:07:19 ubuntu sudo: pam_unix(sudo:auth): auth could not identify password for [rsd3]
Jul 23 11:07:19 ubuntu sudo: rsd3 : 1 incorrect password attempt ; TTY=pts/0 ; PWD=/home/rsd3 ; USER=root ; COMMAND=/bin/bash

Any insight you can provide I'd greatly appreciate. Thanks.

  • Maybe affected by broken_shadow. Run and compare output of sudo getent -s shadow:files shadow and sudo getent -s shadow:nis shadow, could you find any significant difference between them? – yaegashi Jul 24 '15 at 22:36
  • Check also shadow related configs in /etc/login.defs. Read man login.defs for details. – yaegashi Jul 24 '15 at 22:53
  • getent -s shadow:files shadow returned contents of /etc/shadow, which are all the definitions for local users: in particular, I see entries for my local user ("administrator") and what I appended to the end of the file for NIS purposes: +::::::::. When I run getent -s shadow:nis shadow I get nothing at all back. On my reference system (Ubuntu 12.04) the latter returns shadow entries for office NIS users and no +:::::::: line. Thanks @yaegashi for the instructive tip -- getent offers more features, as you demonstrated, than its man page describes. – RSD3 Jul 25 '15 at 2:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.