1

I try to configure pam.d on a centos 8. I wanted to configure system wide umask to 0077 in /etc/pam.d/postlogin.

postlogin is included by several services under /etc/pam.d e.g. su, su-l

My postlogin looks like

session optional                   pam_umask.so umask=0077
session [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
session [default=1]                pam_lastlog.so nowtmp showfailed
session optional                   pam_lastlog.so silent noupdate showfailed

I have tried to login with su -l username aswell as su username and calling umask both will have a umask of 0022.

I have to mention, that the umask is also set in /etc/profile for all accounts to 022.

I also tried to increase pam_umask.so verbosity with debug and consulted the logs /var/log/{messages,secure,audit} there are no entries which explains why pam_umask.so is not working.

3

I have to mention, that the umask is also set in /etc/profile for all accounts to 022.

Every shell that uses /etc/profile will override the umask set by pam_umask.so. So you should set the umask in /etc/profile also to 0077 if you want a system wide umask.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.