3

Occasionally, a systemd unit using a pam module that uses pam_winbind logs a users password.

Systemd unit log:

Mar 25 15:47:41 display-server node[5969]: pam_succeed_if(grooming:auth): requirement "user ingroup marketing department" not met by user "dispatch1"
Mar 25 15:47:41 display-server node[5969]: pam_succeed_if(grooming:auth): requirement "user ingroup dispatch users" was met by user "dispatch1"
Mar 25 15:47:41 display-server node[5969]: pam_winbind(grooming:auth): getting password (0x00004288)
Mar 25 15:47:41 display-server node[5969]: pam_winbind(grooming:auth): user 'dispatch1' granted access
Mar 25 15:47:41 display-server node[5969]: pam_winbind(grooming:auth): Received [<PASSWORD>] reply from application.

PAM module:

#%PAM-1.0
auth      [success=3 default=ignore] pam_succeed_if.so user ingroup [marketing department]
auth      [success=2 default=ignore] pam_succeed_if.so user ingroup [dispatch users]
auth      [success=1 default=ignore] pam_succeed_if.so user ingroup [it department]
auth      requisite pam_deny.so

auth      [success=1 default=ignore] pam_localuser.so
auth      [success=2 default=die] pam_winbind.so
auth      [success=1 default=die] pam_unix.so nullok
auth      requisite pam_deny.so
auth      optional  pam_permit.so
auth      required  pam_env.so

account   required  pam_unix.so
account   [success=1 default=ignore] pam_localuser.so
account   required  pam_winbind.so
account   optional  pam_permit.so
account   required  pam_time.so

password  [success=1 default=ignore] pam_localuser.so
password  [success=2 default=die] pam_winbind.so
password  [success=1 default=die] pam_unix.so sha512 shadow
password  requisite pam_deny.so
password  optional  pam_permit.so

session   required  pam_limits.so
session   required  pam_mkhomedir.so skel=/etc/skel/ umask=0022
session   required  pam_unix.so
session   [success=1 default=ignore] pam_localuser.so
session   required  pam_winbind.so
session   optional  pam_permit.so

Is this an issue with my pam module, an issue with pam_winbind, or something I should fix by adding silent = yes to pam_winbind.conf?

  • silent = yes or editing the PAM lines to include pam_winbind.so silent appear to from the docs do the same thing. I guess to then debug use a test account on a test virt... – thrig Mar 29 '17 at 22:41
  • Debugging is tricky with this one as it only happens every once in a while, and usually stops happening after about a day. – gnarly-line Mar 29 '17 at 22:49
  • Looks like you've got debugging enabled in your pam_winbind.conf. – roaima Sep 23 '17 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.