topic PAM error in Operating System - Linux

PAM error

shrimanth — Mon, 12 Oct 2009 09:52:13 GMT

In ARM processor, we have installed Linux-PAM-1.0.0 version and user has been
created .we are able to login through command prompt successfuly. But when we
try to login through web it is giving following error

pam_unix(passwd:auth): user's record unavailable
pam_unix(passwd:auth): check pass; user unknown
pam_unix(passwd:auth): authentication failure; logname= uid=0 euid=0 tty=
ruser= rhost=

How can we solve this problem ?

Re: PAM error

Steven Schweda — Mon, 12 Oct 2009 14:07:45 GMT

> [...] try to login through web [...]

What does that mean? As usual, showing
actual commands with their actual output can
be more helpful than vague descriptions or
interpretations.

> pam_unix(passwd:auth): user's record unavailable
> pam_unix(passwd:auth): check pass; user unknown

Sounds as if the user name is not valid.
What is it?

Re: PAM error

Andrew Cowan — Tue, 13 Oct 2009 04:22:56 GMT

This usually happens because the program that accepts the login from the web is not PAM aware, or the module has not been added to the "/etc/pam.conf" or "/etc/pam.d/module" depending on your distro.

Here is an example from an AIX box (no Linux to hand), but the principle is the same

sshd account required pam_aix debug
su account sufficient pam_allowroot
telnet account required pam_aix

OTHER password required pam_prohibit

sshd password required pam_aix use_new_state try_first_pass
telnet password required pam_aix

OTHER password required pam_prohibit

sshd session required pam_aix
sshd session required pam_mkuserhome
telnet session required pam_aix

OTHER password required pam_prohibit

In this example PAM can handle requests from both telnet and SSH, and disallows everything else. What you could try is changing the default "prohibit" to "allow" which would mean PAM would automatically allow everything.

The other place to look is your "auth" log files. You can find this file by looking in "/etc/syslog.conf". Where possible set the PAM modules to the highest debug level possible and see which error messages you get.