I did set up a PAM authentication towards LDAP. It's all working correctly but I have an issue when I have both a local user and an ldap user with the same name but different UID.
I'm working on RH6 and currently my system-auth
and password-auth
are configured in this way:
session required pam_mkhomedir.so skel=/etc/skel umask=0002
My ssosers
user exists on ldap
:
[root@localhost pam.d]# getent -s ldap passwd ssosers
ssosers:x:20100:1000:ssosers:/home/ssosers:/usr/bin/sh
And on /etc/passwd
:
[root@localhost pam.d]# cat /etc/passwd | grep ssosers
ssosers:x:50025:50025::/home/ssosers:/bin/bash
My ssosers
can login with both local passwod and ldap password. Please consider that they have different UID. The problem is when I delete the local user to force the authentication against ldap, the next time ssosers
will log in, the pam_mkhomedir.so
fails because the /home/ssosers
already exists and the user can't join to his home due to lack of permissions:
Last login: Mon Feb 19 17:01:00 2018 from 10.212.148.18
Could not chdir to home directory /home/ssosers: Permission denied
-sh: /home/ssosers/.profile: Permission denied
-sh-4.1$
Is there a way to change the permissions of the home directory of the $PAM_USER
if the pam_mkhomedir fails? I would like him to join his old home dir.
UPDATE
I came up with an easy solution. Basically run this script in order to look for the user over the LDAP, if I find it I delete the user and renew the UID of the home folder, if I don't find it I delete both the user and the home directory.
#!/bin/bash
getent -s ldap passwd $1 > /dev/null
if [ $? -eq 0 ]; then
userdel $1
chown -R $1 /home/$1
else
userdel -r $1
fi
But how can I add in the positive case a find based on the OLD UID (looking for other files with the OLD uid)?
By the time I do userdel $1
the local UID (the old one) is no more resolved. This is the permission of the home directory of ssosers
's user after the delete:
drwx------ 3 50025 oinstall 1024 Feb 19 18:30 ssosers
That's why I have to renew the permission of the home with a chown, since the passwd
in the nsswitch
points first to files
and then to ldap
pam_mkhomedir
you would have noticed that it doesn't have any options to do anything like what you want. More importantly, this isn't really a PAM problem. It's just a variation of "I want to change the UID of a user" - and the answer is that if you change a user's UID, you also have to change the owner of all files & directories belonging to the old UID so that they are owned by new UID. e.g.find / -uid OLDUID -exec chown NEWUID {} +
. – cas Feb 20 '18 at 3:03pam_script
. Have you tried reading its docs and writing a script? At a guess, it would probably need to be done in the auth phase, before session (or at least beforepam_mkhomedir
). Try doing that and if you run into problems, edit your question with the code you're having trouble with, along with any relevant error output or log entry. – cas Feb 20 '18 at 8:47