/etc/pam.conf kills session at login for ldap users

[dev44]

Hi,

I have ldap setup and working....sort of. I can see all the ldap users and groups with pwget and grget. However, when I try and login as an ldap user, it askes for the login name then the password and then the line comes up saying "last successful login..blah blah blah" and then kills the session. Only the login shows up in the syslog.

Here is a copy of my /etc/pam.conf, which is simply the /etc/pam.ldap copied onto pam.conf:

#
# PAM configuration
#
# This pam.conf file is intended as an example only.
#
# Please note that this configuration file has only been modified for the
# default services. Other services can be added or modified as
# needed or desired. If a service is not listed, it will use the
# OTHER classification
#
# the format for a entry is
#
#
# Notes:
#
# If the path to a library is not absolute, it is assumed to be relative
# to the directory /usr/lib/security/$ISA/
#
# The "$ISA" (i.e Instruction Set Architecture) token is replaced by the
# PAM engine (libpam) with "hpux64" for IA 64-bit modules, or with "hpux32"
# for IA 32-bit modules, or with "pa20_64" for PA 64-bit modules, or with
# NULL for PA 32-bit modules.
#
# For PA applications, library name ending with "so.1" is a symbolic link
# that points to the corresponding PA (32 or 64-bit) backend library.
#
# see pam.conf(4) for more details
#
# Authentication management
#
login auth required libpam_hpsec.so.1
login auth sufficient libpam_unix.so.1
login auth required libpam_ldap.so.1 try_first_pass
su auth required libpam_hpsec.so.1 bypass_setaud
su auth sufficient libpam_unix.so.1
su auth required libpam_ldap.so.1 try_first_pass
dtlogin auth required libpam_hpsec.so.1
dtlogin auth sufficient libpam_unix.so.1
dtlogin auth required libpam_ldap.so.1 try_first_pass
dtaction auth required libpam_hpsec.so.1
dtaction auth sufficient libpam_unix.so.1
dtaction auth required libpam_ldap.so.1 try_first_pass
ftp auth required libpam_hpsec.so.1
ftp auth sufficient libpam_unix.so.1
ftp auth required libpam_ldap.so.1 try_first_pass
rcomds auth required libpam_hpsec.so.1
rcomds auth sufficient libpam_unix.so.1
rcomds auth required libpam_ldap.so.1 try_first_pass
sshd auth required libpam_hpsec.so.1
sshd auth sufficient libpam_unix.so.1
sshd auth required libpam_ldap.so.1 try_first_pass
OTHER auth required libpam_hpsec.so.1
OTHER auth sufficient libpam_unix.so.1
OTHER auth required libpam_ldap.so.1 try_first_pass
#
# Account management
#
login account required libpam_hpsec.so.1
login account sufficient libpam_unix.so.1
login account required libpam_ldap.so.1
su account required libpam_hpsec.so.1
su account sufficient libpam_unix.so.1
su account required libpam_ldap.so.1
dtlogin account required libpam_hpsec.so.1
dtlogin account sufficient libpam_unix.so.1
dtlogin account required libpam_ldap.so.1
dtaction account required libpam_hpsec.so.1
dtaction account sufficient libpam_unix.so.1
dtaction account required libpam_ldap.so.1
ftp account required libpam_hpsec.so.1
ftp account sufficient libpam_unix.so.1
ftp account required libpam_ldap.so.1
rcomds account required libpam_hpsec.so.1
rcomds account sufficient libpam_unix.so.1
rcomds account required libpam_ldap.so.1
sshd account required libpam_hpsec.so.1
sshd account sufficient libpam_unix.so.1
sshd account required libpam_ldap.so.1
OTHER account required libpam_hpsec.so.1
OTHER account sufficient libpam_unix.so.1
OTHER account required libpam_ldap.so.1
#
# Session management
#
login session required libpam_hpsec.so.1
login session sufficient libpam_unix.so.1
login session required libpam_ldap.so.1
dtlogin session required libpam_hpsec.so.1
dtlogin session sufficient libpam_unix.so.1
dtlogin session required libpam_ldap.so.1
ftp session required libpam_hpsec.so.1 bypass_limit_login bypass_umask bypass_nologin
ftp session sufficient libpam_unix.so.1
ftp session required libpam_ldap.so.1
rcomds session required libpam_hpsec.so.1 bypass_limit_login
rcomds session sufficient libpam_unix.so.1
rcomds session required libpam_ldap.so.1
sshd session required libpam_hpsec.so.1
sshd session sufficient libpam_unix.so.1
sshd session required libpam_ldap.so.1
OTHER session required libpam_hpsec.so.1
OTHER session sufficient libpam_unix.so.1
OTHER session required libpam_ldap.so.1
#
# Password management
#
login password required libpam_hpsec.so.1
login password sufficient libpam_unix.so.1
login password required libpam_ldap.so.1 try_first_pass
passwd password required libpam_hpsec.so.1
passwd password sufficient libpam_unix.so.1
passwd password required libpam_ldap.so.1 try_first_pass
dtlogin password required libpam_hpsec.so.1
dtlogin password sufficient libpam_unix.so.1
dtlogin password required libpam_ldap.so.1 try_first_pass
sshd password required libpam_hpsec.so.1
sshd password sufficient libpam_unix.so.1
sshd password required libpam_ldap.so.1 try_first_pass
OTHER password required libpam_hpsec.so.1
OTHER password sufficient libpam_unix.so.1
OTHER password required libpam_ldap.so.1 try_first_pass

[Bob Neal-Joslin · Accepted solution]

Hi,

I don't see any obvious faults in the pam.conf file. And by your statement that it says "Last login...", seems to indicate the login completes successfully. So I would suggest seeing if it's something in your shell's login profile. First, double check to make sure that the user's shell shows up correctly using pwget -n username. Then, assuming sh/ksh, look at the user's .profile. Insert an "echo I am here 1", "echo I am here 2" in various places in the .profile and see if you can narrow down where in the .profile it might be aborting. Not sure that is the issue, but that's where I'd start debugging.

Also run the command "/opt/ldapux/ldapcfinfo -t passwd" and see if it reports any errors.

Good Luck,

Bob

[dev44]

Thanks Bob....your first sentence triggered it for me....no home directory. Now with Linux, I can add the following to the bottom of my system-auth file and it is created if missing. Hopefully HP-UX has something similar.

session required pam_mkhomedir.so umask=0022 skel=/etc/skel silent