1

I am trying to use the Pluggable Authentication Module to execute a script when login fails on my Arch Linux system. Arch Linux does not have a common-auth file and I decided not to create one either. Instead I found that the PAM stack uses the system-auth file for some functionalities and I decided to edit it.

The original system-auth file was as follows

#%PAM-1.0

auth      required  pam_unix.so     try_first_pass nullok
auth      optional  pam_permit.so
auth      required  pam_env.so

account   required  pam_unix.so
account   optional  pam_permit.so
account   required  pam_time.so

password  required  pam_unix.so     try_first_pass nullok sha512 shadow
password  optional  pam_permit.so

session   required  pam_limits.so
session   required  pam_unix.so
session   optional  pam_permit.so


To execute the script when login fails, I changed the auth block as follows

auth      [success=1 default=ignore]  pam_unix.so     try_first_pass nullok
auth      optional  pam_exec.so <path to the script file>
auth      optional  pam_permit.so
auth      required  pam_env.so

account   required  pam_unix.so
account   optional  pam_permit.so
account   required  pam_time.so

password  required  pam_unix.so     try_first_pass nullok sha512 shadow
password  optional  pam_permit.so

session   required  pam_limits.so
session   required  pam_unix.so
session   optional  pam_permit.so

The sudo command is one command that uses this system-auth file in the PAM stack on my system. However when I try to use the sudo command after editing the file as above, the sudo command executes even if I enter the incorrect password.

Would appreciate if someone could tell me what is going wrong here and help me to correct it

  • 1
    Shouldn't it be default=bad? Check the equivalent of required in manpages.ubuntu.com/manpages/trusty/en/man5/pam.d.5.html – muru Feb 28 '17 at 6:17
  • @muru, replacing "default=ignore" with "default=bad" as suggested worked. Thank you! Could you please post it as an answer so that I can select it as the correct answer? – Nilushan Mar 2 '17 at 9:08
1

From man pam.d, the description of required:

required
   [success=ok new_authtok_reqd=ok ignore=ignore default=bad]

With default=ignore, the failure from pam_unix is no longer leads to failing of authentication, since your script, and then pam_permit.so will be used and pam_permit.so always succeeds. pam_unix should still have default=bad:

bad
   this action indicates that the return code should be thought of as
   indicative of the module failing. If this module is the first in
   the stack to fail, its status value will be used for that of the
   whole stack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.