2

On a certain RHEL5 machine, when root is executing commands such as passwd someuser or any other privileged command, the root password is requested for verification and the command can't be executed without it.

Example:

# id
uid=0(root) gid=0(root)  
groups=0(root),10(wheel)
# passwd someuser
Password:(need to enter root verification password to proceed)
New user password:
Retype new password:
  • root user is present in the /etc/sudoers file as shown below:

    root ALL=(ALL) ALL
    
  • All basic files in /etc/pam.d/ such as login, passwd, password-auth, password-auth-ac, system-auth-ac, system-auth, sudo, sudo-l are the same as those on another machine that doesn't behave in the same way.

  • SElinux is disabled.

  • /etc/nsswitch.conf is unchanged and consistent with other machines.

    passwd:         files ldap 
    group:          files ldap 
    shadow:         files ldap 
    hosts:          files dns
    networks:       files
    protocols:      files
    services:       files
    ethers:         files
    rpc:            files
    netgroup:       files
    sudoers:  files ldap
    
  • Not much information can be seen from logs files as listed below when executing passwd command:

    /etc/log/secure - empty (Unfortunately I'm not allowed to touch rsyslog)

    /etc/log/auth.log

    sshd[xxxxx]:  Accepted keyboard-interactive/pam for root from 127.0.0.XX port XXXXX ssh2
    sshd[xxxxx]:  pam_unix(sshd:session): session opened for user root by (uid=0)
    
  • The same thing happens when connected directly (without ssh) to the console.

Has anyone experienced similar behavior?

Or can you please recommend any debugging flag or a method that can help in finding the cause of the problem?

  • What is the password prompt for "any other privileged command"? – techraf Feb 25 '16 at 7:26
  • Other privileged commands that I have noticed so far are not default linux commands. Usually these commands can be executed only by super user root but without authentication. Commands such as "cat /etc/passwd, "crontab -l -u someuser", "su - someuser", do not request root authentication when logged in with root. – 3nk1 Feb 25 '16 at 7:48
  • Well, if some commands sometimes require password then you probably won't get answers here. – techraf Feb 25 '16 at 7:51
  • Usually neither "some" nor the default linux commands require password. passwd command shouldn't be asking for root password when run by root. – 3nk1 Feb 25 '16 at 7:58
  • 3
    Can you run sudo rpm -V passwd shadow-utils and see if there are any errors? You could be running a locally modified version of passed. – Mark Plotnick Feb 25 '16 at 9:23
0

This is very likely related to your pam configuration. I'm not sure if it's exactly the same in RHEL 5, but in RHEL 6, authentication by account succeeds by default for users with a UID < 500 because /etc/pam.d/system-auth contains the line:

account     sufficient    pam_succeed_if.so uid < 500 quiet

Like other authenication related tools on RHEL, /usr/bin/passwd makes use of pam and the configuration in /etc/pam.d.

Restoring /etc/pam.d/system-auth by running yum reinstall pam or extracting /etc/pam.d/system-auth from the rpm is probably your safest bet. The existing system-auth file may not be overwritten, but written as system-auth.rpmnew.

0

Firstly, thank you all for your help.

The problem was solved after generating new ssh keys:

# ssh-keygen -t rsa

I found discrepancy between authorized_keys2 and id_rsa.pub files and thus generated new keys. I honestly had no idea that it could solve the problem as I stopped suspecting ssh since I've noticed that problem was happening on console connection too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.