0

I am writing an application that forces the user to change his password after the first login. I set a blank password for this admin user with

passwd -d admin

and verified that no password was set in /etc/shadow

# grep admin /etc/shadow
admin::17834:0:99999:7:::

However, my attempts to login from the console (not ssh) all fail. Can one or more rules in /etc/pam.d/* be tweaked to allow this login? I had once built a debug version of pam and replaced the default library with it (in a custom ISO) to understand which rules were being invoked but it generated humongous amount of log messages.

UPDATE: I (force-)installed a PAM RPM built with debugging enabled and captured all logs pertinent to a login attempt from the console:

[pam_item.c:pam_set_item(31)] called
[pam_delay.c:_pam_start_timer(42)] starting timer...
[pam_handlers.c:_pam_init_handlers(342)] _pam_init_handlers called
[pam_dispatch.c:_pam_dispatch_aux(106)] passing control to module...
[pam_item.c:pam_get_item(179)] called.
[pam_item.c:pam_get_item(201)] returning userprompt=(null)
[pam_item.c:pam_get_user(281)] called.
[misc_conv.c:misc_conv(279)] allocating empty response structure array.
[misc_conv.c:misc_conv(288)] entering conversation function.
[misc_conv.c:read_string(136)] called with echo='ON', prompt='lnxserver login: '.
[misc_conv.c:read_string(203)] we got some user input
[pam_item.c:pam_set_item(31)] called
[pam_item.c:pam_get_user(380)] completed
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_set_data(70)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_modutil_getpwnam.c:pam_modutil_getpwnam(92)] success
[pam_dispatch.c:_pam_dispatch_aux(114)] module returned: Error in service module
[pam_dispatch.c:_pam_dispatch_aux(198)] use_cached_chain=0 action=0 cached_retval=3 retval=3
[pam_dispatch.c:_pam_dispatch_aux(106)] passing control to module...
[pam_item.c:pam_get_user(281)] called.
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_set_data(70)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_modutil_getpwnam.c:pam_modutil_getpwnam(92)] success
[pam_dispatch.c:_pam_dispatch_aux(114)] module returned: Success
[pam_dispatch.c:_pam_dispatch_aux(198)] use_cached_chain=0 action=-1 cached_retval=0 retval=0
[pam_dispatch.c:_pam_dispatch_aux(100)] skipping substack handler
[pam_dispatch.c:_pam_dispatch_aux(106)] passing control to module...
[pam_dispatch.c:_pam_dispatch_aux(114)] module returned: The return value should be ignored by PAM dispatch
[pam_dispatch.c:_pam_dispatch_aux(198)] use_cached_chain=0 action=0 cached_retval=25 retval=25
[pam_dispatch.c:_pam_dispatch_aux(106)] passing control to module...
[pam_delay.c:pam_fail_delay(141)] setting delay to 2000000
[pam_delay.c:pam_fail_delay(150)] largest = 0
[pam_delay.c:pam_fail_delay(153)] resetting largest delay
[pam_item.c:pam_get_user(281)] called.
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_set_data(70)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_modutil_getpwnam.c:pam_modutil_getpwnam(92)] success
[pam_dispatch.c:_pam_dispatch_aux(114)] module returned: Success
[pam_dispatch.c:_pam_dispatch_aux(198)] use_cached_chain=0 action=-1 cached_retval=0 retval=0
[pam_dispatch.c:_pam_dispatch_aux(106)] passing control to module...
[pam_unix_auth.c:pam_sm_authenticate(112)] called.
[support.c:_set_ctrl(139)] called.
[support.c:_set_ctrl(146)] IAMROOT
[support.c:_set_ctrl(279)] done.
[pam_item.c:pam_get_user(281)] called.
[support.c:_unix_blankpasswd(680)] called
[support.c:_unix_read_password(888)] called
[pam_item.c:pam_get_item(179)] called.
[misc_conv.c:misc_conv(279)] allocating empty response structure array.
[misc_conv.c:misc_conv(288)] entering conversation function.
[misc_conv.c:read_string(136)] called with echo='OFF', prompt='Password: '.
[misc_conv.c:read_string(203)] we got some user input
[pam_item.c:pam_set_item(31)] called
[pam_item.c:pam_get_item(179)] called.
[pam_unix_auth.c:pam_sm_authenticate(175)] user=admin, password=[]
[support.c:_unix_verify_password(730)] called
[support.c:_unix_verify_password(734)] setting delay
[pam_delay.c:pam_fail_delay(141)] setting delay to 2000000
[pam_delay.c:pam_fail_delay(150)] largest = 2000000
[support.c:_unix_verify_password(741)] locating user's record
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_set_data(70)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_modutil_getpwnam.c:pam_modutil_getpwnam(92)] success
[support.c:_unix_verify_password(755)] running helper binary
[support.c:_unix_run_helper_binary(544)] called.
[passverify.c:verify_pwd_hash(74)] called
[passverify.c:verify_pwd_hash(84)] user has empty password - access denied
[passverify.c:verify_pwd_hash(133)] done [7].
[support.c:_unix_run_helper_binary(662)] returning 7
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_item.c:pam_get_item(179)] called.
[pam_item.c:pam_get_item(179)] called.
[pam_item.c:pam_get_item(179)] called.
[pam_item.c:pam_get_item(179)] called.
[pam_item.c:pam_get_item(206)] returning tty=tty1
[pam_data.c:pam_set_data(70)] called
[pam_data.c:_pam_locate_data(46)] called
[support.c:_unix_verify_password(867)] done [7].
[pam_unix_auth.c:pam_sm_authenticate(181)] recording return code for next time [7]
[pam_data.c:pam_set_data(70)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_unix_auth.c:pam_sm_authenticate(181)] done. [Authentication failure]
[pam_dispatch.c:_pam_dispatch_aux(114)] module returned: Authentication failure
[pam_dispatch.c:_pam_dispatch_aux(198)] use_cached_chain=0 action=-3 cached_retval=7 retval=7
[pam_dispatch.c:_pam_dispatch_aux(106)] passing control to module...
[pam_delay.c:pam_fail_delay(141)] setting delay to 2000000
[pam_delay.c:pam_fail_delay(150)] largest = 2000000
[pam_item.c:pam_get_user(281)] called.
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_get_data(123)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_data.c:pam_set_data(70)] called
[pam_data.c:_pam_locate_data(46)] called
[pam_modutil_getpwnam.c:pam_modutil_getpwnam(92)] success
[pam_item.c:pam_get_item(179)] called.
[pam_item.c:pam_get_item(179)] called.
[pam_item.c:pam_get_item(206)] returning tty=tty1
[pam_dispatch.c:_pam_dispatch_aux(114)] module returned: The return value should be ignored by PAM dispatch
[pam_dispatch.c:_pam_dispatch_aux(198)] use_cached_chain=0 action=-4 cached_retval=25 retval=25
[pam_item.c:pam_set_item(31)] called
[pam_item.c:pam_set_item(31)] called
[pam_delay.c:_pam_await_timer(90)] waiting?...
[pam_delay.c:_pam_compute_delay(76)] random number: base=2000000 -> ans=1674256

[pam_delay.c:_pam_await_timer(114)] will wait 1674256 usec
[pam_delay.c:_pam_reset_timer(27)] setting pamh->fail_delay.set to FALSE
[pam_delay.c:_pam_await_timer(126)] waiting done
[pam_auth.c:pam_authenticate(39)] pam_authenticate exit
[pam_item.c:pam_get_item(179)] called.
[pam_item.c:pam_get_item(196)] returning user=admin
[pam_item.c:pam_set_item(31)] called
[pam_auth.c:pam_authenticate(18)] pam_authenticate called
[pam_item.c:pam_set_item(31)] called
[pam_item.c:pam_set_item(31)] called
[pam_delay.c:_pam_start_timer(42)] starting timer...
[pam_handlers.c:_pam_init_handlers(342)] _pam_init_handlers called
[pam_dispatch.c:_pam_dispatch_aux(106)] passing control to module...
[pam_item.c:pam_get_item(179)] called.
[pam_item.c:pam_get_item(201)] returning userprompt=(null)
[pam_item.c:pam_get_user(281)] called.
[misc_conv.c:misc_conv(279)] allocating empty response structure array.
[misc_conv.c:misc_conv(288)] entering conversation function.
[misc_conv.c:read_string(136)] called with echo='ON', prompt='lnxserver login: '.

Looking at the source, a check in modules/pam_unix/passverify.c (must be pam_unix.so) is tripping

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.