Re: OpenSSH ignores PAM?

From: Ryan Hadley (rhadley_at_interlinknetworks.com)
Date: 10/18/03

  • Next message: Rick Cone, Secure Payment Systems: "ssh remote command exectuion using cron" 
    Date: Fri, 17 Oct 2003 22:10:21 -0400
To: Florian Effenberger <floeff@arcor.de>

    I believe you need something like this in your sshd_config:

    PasswordAuthentication no
    UsePAM yes

    But, keep in mind that the new ssh requries TIS or Keyboard Interactive mode.

    Read this thread: http://marc.theaimsgroup.com/?l=secure-shell&m=106562915009932&w=2

    -Ryan

    On Thu, Oct 16, 2003 at 10:23:44PM +0200, Florian Effenberger wrote:
    > Hi there,
    >
    > Seems I have trouble to get OpenSSH to use PAM...
    >
    > I compiled the most recent version using
    > ./configure --with-pam --with-md5-passwords
    >
    > My /etc/pam.d/sshd (on Debian) reads
    > #%PAM-1.0
    > auth required /lib/security/pam_unix.so shadow nodelay debug
    > auth required /lib/security/pam_nologin.so debug
    > account required /lib/security/pam_unix.so debug
    > password required /lib/security/pam_cracklib.so debug
    > password required /lib/security/pam_unix.so shadow nullok use_authtok
    > debug
    > session required /lib/security/pam_unix.so debug
    > session required /lib/security/pam_limits.so debug
    > session required pam_chroot.so debug
    >
    > The items in sshd_conf read
    > Protocol 2
    > UseLogin no
    > UsePrivilegeSeparation no
    > Subsystem sftp /usr/local/libexec/sftp-server
    > AllowTcpForwarding no
    >
    > However, /var/log/auth.log has no entries, even though I set "debug". When I
    > have "UseLogin yes" and add some debug in the appropriate PAM file, I get
    > output in auth.log
    >
    > Could it be that my OpenSSH does not use PAM? Compiliation went okay, and
    > ./configure told me PAM would be used... :-(
    >
    > Thanks
    > Florian
    >

  • Next message: Rick Cone, Secure Payment Systems: "ssh remote command exectuion using cron"

    Relevant Pages

    • OpenSSH ignores PAM?
      ... Seems I have trouble to get OpenSSH to use PAM... ... auth required /lib/security/pam_unix.so shadow nodelay debug ... password required /lib/security/pam_unix.so shadow nullok use_authtok ... Compiliation went okay, and ...
      (SSH)
    • FreeBSD Security Advisory FreeBSD-SA-06:09.openssh
      ... For general information regarding FreeBSD Security Advisories, ... Privilege separation is a mechanism used by OpenSSH to protect itself ... OpenSSH to fork a child process to handle calls to the PAM framework. ... The following command will show a list of orphaned PAM processes: ...
      (FreeBSD-Security)
    • [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-06:09.openssh
      ... For general information regarding FreeBSD Security Advisories, ... Privilege separation is a mechanism used by OpenSSH to protect itself ... OpenSSH to fork a child process to handle calls to the PAM framework. ... The following command will show a list of orphaned PAM processes: ...
      (freebsd-announce)
    • FreeBSD Security Advisory FreeBSD-SA-06:09.openssh [REVISED]
      ... For general information regarding FreeBSD Security Advisories, ... Privilege separation is a mechanism used by OpenSSH to protect itself ... OpenSSH to fork a child process to handle calls to the PAM framework. ... The following command will show a list of orphaned PAM processes: ...
      (Bugtraq)
    • FreeBSD Security Advisory FreeBSD-SA-06:09.openssh [REVISED]
      ... For general information regarding FreeBSD Security Advisories, ... Privilege separation is a mechanism used by OpenSSH to protect itself ... OpenSSH to fork a child process to handle calls to the PAM framework. ... The following command will show a list of orphaned PAM processes: ...
      (FreeBSD-Security)
    • Quantcast