topic Re: pam_wheel.so on SuSE in Operating System - Linux

pam_wheel.so on SuSE

Jeff_Traigle — Thu, 07 Sep 2006 13:50:41 GMT

On our SuSE systems that have pam-0.80-6 and no NIS, I'm able to include the following line in /etc/pam.d/su and it restricts su to root to members of the wheel group as expected:

auth requisite pam_wheel.so group=wheel

However, on some older installs with pam-0.77-124 or pam-0.77-221 using NIS, this same line doesn't quite work. It seems to work as expected for local users, but, if the user is defined in NIS, it allows them to su to root regardless of the wheel restriction.

The complete /etc/pam.d/su is:

#%PAM-1.0
auth sufficient pam_rootok.so
auth requisite pam_wheel.so group=wheel
auth required pam_unix2.so nullok #set_secrpc
account required pam_unix2.so
password required pam_pwcheck.so nullok
password required pam_unix2.so nullok use_first_pass use_authtok
#session required pam_homecheck.so
session required pam_unix2.so debug # none or trace

These are significantly different from the pam-0.80-6 entries:

#%PAM-1.0
auth sufficient pam_rootok.so
auth requisite pam_wheel.so group=wheel
auth include common-auth
account include common-account
password include common-password
session include common-session
session optional pam_xauth.so

Anyone who knows PAM well want to take a stab at explaining this? A bug? A configuration problem?

Re: pam_wheel.so on SuSE

Ivan Ferreira — Thu, 07 Sep 2006 14:23:15 GMT

So, any of the versions works with NIS? Can you add the debug option to the pam_wheel module and post the syslog messages?

Re: pam_wheel.so on SuSE

Jeff_Traigle — Thu, 07 Sep 2006 14:37:21 GMT

Ugh! Now it appears to be working properly even with the NIS users. Maybe it just needs to think about it for a while. :)

Re: pam_wheel.so on SuSE

Steven E. Protter — Thu, 07 Sep 2006 14:38:53 GMT

Shalom,

I believe it is a bug in the libwrap.so with tcp wrappers.

I don't know a lot about tcp_wrappers but just went through the basics during RHCE training.

SEP

Re: pam_wheel.so on SuSE

Ryan Goh — Thu, 07 Sep 2006 23:15:57 GMT

Hi,

You can actually configure using webmin or Yast tool.