topic Re: accounts cannot log in in Operating System - HP-UX

accounts cannot log in

Dave Chamberlin — Fri, 14 Sep 2007 11:37:59 GMT

Hello. On my rp7400 running HPUX 11.0, we recently installed an RSA agent as a test. Since the installation - we are unable to telnet to the machine as any user. I also cannot log on as any user on the console. I do have a root xwindow open to the server, so I looked in the syslog.log file and saw messages like "...ACEAGENT: the message entry does not exist..."
We uninstalled the RSA agent, but are still not able to login to the machine. The syslog log has "Could not read the sd_pam.conf file". Can someone help? Thanks.

Re: accounts cannot log in

Carsten.Cimander — Fri, 14 Sep 2007 20:41:32 GMT

Hello Dave,

perhaps check, if it is a permission / owner problem of the sd_pam.conf file.

Have you any ACL (access control lists) activated or implemented? (see above).

Perhaps the sd_pam.conf file is corrupted.

Reference Material
Key documentation on PAM can be obtained from the kernel web site here:
http://www.kernel.org/pub/linux/libs/pam/
There are 3 PAM documents of interest on the kernel site:
â ¢ The System Administratorsâ Guide:
http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam.html
â ¢ The Module Writersâ Manual:
http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/Linux-PAM_MWG.html
â ¢ The Application Developersâ Manual:
http://www.kernel.org/pub/linux/libs/pam/Linux-PAM-html/Linux-PAM_ADG.html
The original RFC for PAM can be obtained form the Open Group web site here:
â ¢ http://www.opengroup.org/tech/rfc/mirror-rfc/rfc86.0.txt

Regards,
Carsten

Re: accounts cannot log in

Sameer_Nirmal — Fri, 14 Sep 2007 21:36:19 GMT

The file sd_pam.conf file belongs to RSA agent. As per the RSA documentation at http://theether.net/download/RSA/SecurID/6.0/PAMAgent.pdf ,before un-installing the RSA agent, the system should be configured with the standard OS PAM module. It seems that it wasn't done and ended up this problem which still refers to the RSA PAM module.

You need to restore the original /etc/pam.conf file which will allow users to login.

Re: accounts cannot log in

John Fjeldberg — Sun, 16 Sep 2007 20:25:51 GMT

Check the /etc/pam.config and verify that all the login lines are using the standard 'libpam_unix.1', e.g:
login auth required /usr/lib/security/libpam_unix.1

If you want a service to use a different pam module, e.g. RSA for FTP login, change that line to use 'pam_securid.1'