PAM: can't get libpam_updbe.1 to work

[mark suhovecky]

I had another user post part of this earlier, so my apologies if you've read it before.

I have a PAM library to do RADIUS authentication. If I set my pam.conf like this

login auth sufficient /usr/lib/security/pam_radius_auth.so debug
login password sufficient /usr/lib/security/pam_radius_auth.so debug

Everything works fine. The PAM log looks like this:

Jun 16 17:25:05 hpj67501 : pam_radius_auth: Got user name suhoveck
Jun 16 17:25:11 hpj67501 : pam_radius_auth: Sending RADIUS request code 1
Jun 16 17:25:11 hpj67501 : pam_radius_auth: Got RADIUS response code 2
Jun 16 17:25:11 hpj67501 : pam_radius_auth: authentication succeeded
Jun 16 17:25:11 hpj67501 : pam_sm_setcred(): no module data

Then I tried using libpam_updbe.1 to allow users listed in pam_user avoid RADIUS. I changed pam.conf to this:

login auth sufficient /usr/lib/security/libpam_updbe.1 debug
login auth required /usr/lib/security/pam_radius_auth.so debug
login password sufficient /usr/lib/security/libpam_updbe.1 debug
login password required /usr/lib/security/pam_radius_auth.so debug

I also changed pam_user.conf to contain:

suhoveck auth /usr/lib/security/libpam_unix.1 debug
suhoveck password /usr/lib/security/libpam_unix.1 debug

I would expect from this configuration that user suhoveck would be authenticated against /etc/passwd, and all others against RADIUS.

When I do this; however, anyone trying to login (including root) is let in without a password challenge at all. The PAM log shows only

Jun 16 17:50:04 hpj67501 : pam_sm_setcred(): no module data

I've searched this forum, found several instances of folks with the same problem (see postings on 2/07 & 6/11) and in every case so far, the solution has been to work around it, and not use pamlib_updbe.

If there's someone out there who's using it, and can provide a counterexample, I'd love to see it

My example was run on a J6750 running 11. The machine's swlist is attached.

Any help is appreciated.

Thanks,

Mark