2

I want to use my Windows AD credentials to login the Ubuntu 16.04 machine. I use PBIS (PowerBroker Identity Services) AD-bridge from Beyondtrust version 8.5.2.265. Windows version is Windows Server 2012 R2.

These errors pop up in /var/log/auth.log:

Jan 16 08:34:51 [HOSTNAME] lightdm: PAM adding faulty module: pam_kwallet5.so
Jan 16 08:34:59 [HOSTNAME] lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "Administrator@winsrv.local"
Jan 16 08:35:01 [HOSTNAME] CRON[12249]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 16 08:35:01 [HOSTNAME] CRON[12249]: pam_unix(cron:session): session closed for user root
Jan 16 08:35:03 [HOSTNAME] lightdm: [lsass-pam] [module:pam_lsass]User Administrator@winsrv.local is denied access because they are not in the 'require membership of' list
Jan 16 08:35:03 [HOSTNAME] lightdm: [lsass-pam] [module:pam_lsass]pam_sm_authenticate error [login:Administrator@winsrv.local][error code:40158]
Jan 16 08:35:07 [HOSTNAME] systemd-logind[1050]: Removed session c2.

I have changed the configuration option RequireMembershipOf to match the security group "domain^users" which I copied from /opt/pbis/bin/enum-groups

The options from /opt/pbis/bin/config --dump:

AllowDeleteTo ""
AllowReadTo ""
AllowWriteTo ""
MaxDiskUsage 104857600
MaxEventLifespan 90
MaxNumEvents 100000
DomainSeparator "\\"
SpaceReplacement "^"
EnableEventlog false
SaslMaxBufSize 16777215
Providers "ActiveDirectory"
DisplayMotd false
PAMLogLevel "error"
UserNotAllowedError "Access denied"
AssumeDefaultDomain true
CreateHomeDir true
CreateK5Login true
SyncSystemTime true
TrimUserMembership true
LdapSignAndSeal false
LogADNetworkConnectionEvents true
NssEnumerationEnabled true
NssGroupMembersQueryCacheOnly true
NssUserMembershipQueryCacheOnly false
RefreshUserCredentials true
CacheEntryExpiry 14400
DomainManagerCheckDomainOnlineInterval 300
DomainManagerUnknownDomainCacheTimeout 3600
MachinePasswordLifespan 2592000
MemoryCacheSizeCap 0
HomeDirPrefix "/home"
HomeDirTemplate "%H/%U"
RemoteHomeDirTemplate ""
HomeDirUmask "022"
LoginShellTemplate "/bin/bash"
SkeletonDirs "/etc/skel"
UserDomainPrefix "winsrv.local"
DomainManagerIgnoreAllTrusts false
DomainManagerIncludeTrustsList
DomainManagerExcludeTrustsList
RequireMembershipOf "domain^users"
Local_AcceptNTLMv1 true
Local_HomeDirTemplate "%H/local/%D/%U"
Local_HomeDirUmask "022"
Local_LoginShellTemplate "/bin/sh"
Local_SkeletonDirs "/etc/skel"
UserMonitorCheckInterval 1800
LsassAutostart true
EventlogAutostart true
BlacklistDC

/etc/pam.d/common-session file:

# here are the per-package modules (the "Primary" block)
session [default=1]                     pam_permit.so
# here's the fallback if no module succeeds
session requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required                        pam_permit.so
# The pam_umask module will set the umask according to the system default in
# /etc/login.defs and user settings, solving the problem of different
# umask settings with different shells, display managers, remote sessions etc.
# See "man pam_umask".
session optional                        pam_umask.so
# and here are more per-package modules (the "Additional" block)
session optional        pam_lsass.so
session required        pam_unix.so
session optional        pam_systemd.so
session optional        pam_ecryptfs.so unwrap
# end of pam-auth-update config

/etc/pam.d/common-auth file:

# here are the per-package modules (the "Primary" block)
auth    [success=2 default=ignore]      pam_lsass.so
auth    [success=1 default=ignore]      pam_unix.so nullok_secure
# here's the fallback if no module succeeds
auth    requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional        pam_ecryptfs.so unwrap
# end of pam-auth-update config

/etc/pam.d/common-account file:

# here are the per-package modules (the "Primary" block)
account [success=ok new_authtok_reqd=ok default=ignore]         pam_lsass.so unknown_ok
account [success=2 new_authtok_reqd=done default=ignore]        pam_lsass.so
account [success=1 new_authtok_reqd=done default=ignore]        pam_unix.so
# here's the fallback if no module succeeds
account requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
  • This message lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "Administrator@winsrv.local" only means that for this user no passwordless login is enabled. It's not an error, just a diagnostic message. – yktoo Mar 12 at 12:15
2

I solved the same issue. I had

pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "xxxxxxx"

in an environment with AD authentification, Windows 2016, ubuntu 16.04.

The solution

Edit /etc/pam.d/lightdm and remove nopasswdlogin from this line:

auth    sufficient      pam_succeed_if.so user ingroup nopasswdlogin
  • 1
    @Toby: not a solution: you'll get another error instead: "incomplete condition detected" – rosch Nov 6 '18 at 13:44
  • @rosch: I only edited - Hugo wrote the answer (and has been very quiet since). – Toby Speight Nov 6 '18 at 13:46
  • This solved it for me on Ubuntu 18.04, but I'm not sure why it solves it -- after all, with the sufficient flag it should continue the authentication. – Thor Jan 15 at 9:40
  • This is not a solution, this is misconfiguration. You'd better comment out this line entirely (put a # at the beginning). – yktoo Mar 12 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.