4

I would like to know the correct procedure to uninstall a PAM module that was installed using apt install.

I had "libpam-shield" https://packages.debian.org/stable/admin/libpam-shield installed on a server (debian 9, running ssh, imap) to block IPs with repeated authentication failures. (I had used apt install libpam-shield to install it from the Debian stable repository.) Later I decided not to use it, so I uninstalled it using apt remove libpam-shield. However even after this, the file /etc/pam.d/common-auth contains an uncommented line auth optional pam_shield.so which causes repeated warning lines in /var/log/auth.log:

PAM unable to dlopen(pam_shield.so): /lib/security/pam_shield.so: cannot open shared object file: No such file or directory
PAM adding faulty module: pam_shield.so

Hence I commented out the line from common-auth mentioned above, but that started causing authentication errors for imap and ssh authentication attempts.

grep shield -r /etc/pam* did not show any other location where pam_shield is mentioned. What other changes should I make in the PAM config files to make the error about not finding pam_shield.so go away? I rebooted the server after uninstalling libpam-shield.

Added: Here are the lines from /etc/pam.d/common-auth.

auth    [success=3 default=ignore]      pam_unix.so nullok_secure
auth    optional pam_shield.so 
auth    [success=1 default=ignore]      pam_ldap.so use_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
2

Looking at PAM documentation:

For the more complicated syntax valid control values have the following form:

    [value1=action1 value2=action2 ...]

[...]

The actionN can take one of the following forms:

[...]

N (an unsigned integer)

    equivalent to ok with the side effect of jumping over the next N modules in the stack. Note that N equal to 0 is not allowed (and it would be identical to ok in such case).

So success=n skips n lines. So if you remove the auth optional pam_shield.so line, you have to skip one less line and so turn the first line into:

auth    [success=2 default=ignore]      pam_unix.so nullok_secure

The goal being to jump to pam_permit.so on success or next method else (except for pam_shield, of which I wonder if it shouldn't have been put after pam_ldap for good effect, but I don't know enough about this).

But actually all this should have been automatically managed on package removal by the use (from package) of the command pam-auth-update to handle automatic reconfiguration. Maybe something went wrong during package removal.

In all my attempts made to install and uninstall libpam-shield and libpam-ldap in any order the configuration was always handled as expected (relevant line disappears when the package is removed), so I'm puzzled why it went wrong for you.

I'd advise to:

  • make sure you don't shoot yourself in the foot. Always have a method to keep or recover access
  • reinstall and re uninstall the package libpam-shield to try and have the correct setting done by the distribution.
  • run pam-auth-update. It shouldn't mention "PAM shield: block IPs trying password guessing" in the offered list anymore or something is still wrong. If it's still mentioned, you can just choose to disable it, so the proper configuration will be rebuilt anyway.

UPDATE: also, as is explained in the man page:

The script makes every effort to respect local changes to /etc/pam.d/common-*. Local modifications to the list of module options will be preserved, and additions of modules within the managed portion of the stack will cause pam-auth-update to treat the config files as locally modified and not make further changes to the config files unless given the --force option.

If manual changes were done clashing with the comments about it in /etc/pam.d/common-auth, then probably pam-auth-update will avoid changing it. This can still be reset to default package handling using:

pam-auth-update --force

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.