So, I have a CentOS 7.2 system and I used realmd to join the AD domain. I can do a # id {username}@{domain} which perfectly lists all of the AD information for that user. Awesome!
Using stock pam.d/system-auth and pam.d/password-auth files, I can ssh and login in as an AD user just fine.
But, when I attempt to use a hardened system-auth and password-auth, things get screwy. I have narrowed it down do the password-auth file, and specifically, the pam_faillock auth section.
Here is what I have for /etc/pam.d/password-auth
auth required pam_env.so
auth [default=1 success=ok] pam_localuser.so debug
auth required pam_faillock.so preauth audit deny=5 unlock_time=900
auth sufficient pam_unix.so nullok try_first_pass audit
auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900
auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session optional pam_oddjob_mkhomedir.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
When attempting to authenticate, either on the console or ssh, I get the following:
Oct 07 12:07:48 vmcentos72 sshd[8406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=user@domain
If I remove those pam_faillock lines in the auth section, it works just fine.
Here is system-auth:
auth required pam_env.so
auth [default=1 success=ok] pam_localuser.so
auth required pam_faillock.so preauth audit silent deny=5 unlock_time=900
auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass
auth [default=die] pam_faillock.so authfail audit deny=5 unlock_time=900
auth sufficient pam_faillock.so authsucc audit deny=5 unlock_time=900
auth requisite pam_succeed_if.so uid >= 1000 quiet_success
auth sufficient pam_sss.so forward_pass
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 1000 quiet
account [default=bad success=ok user_unknown=ignore] pam_sss.so
account required pam_permit.so
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_sss.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session optional pam_oddjob_mkhomedir.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_sss.so
Any suggestions for getting this working? If only pam_faillock had a debug option :(
pam_faillock
? Presumably your AD handles locking accounts for failed login attempts. Adding faillock to the mix can mix things all up. If the only local account logging in isroot
, I would say you don't needpam_faillock
at all.pam_faillock.so
line in youraccount
stack. It should be the fist line ofaccount
withrequired
.password-auth
andsystem-auth
should also be identical. Are they? It's also recommended not to edit these directly. For example, usepassword-auth-ac
for your specific config and makepassword-auth
a soft link topassword-auth-ac
. Use the same logic forsystem-auth
.