Shadow Password Product with SSH and SUDO

[Michael R. Monteith]

I just installed and was testing Shadow Password B.01.00.00 and it does not work with SSH and SUDO.

I suspect it's because those products aren't using PAM authentication.

But I was wondering if there are settings somewhere that might correct this or if it's an issue with Shadow Password or the SSH or SUDO?

I haven't played with SSH or SUDO on trusted systems, but I assume they work.

[James A. Donovan]

You'll need to determine how your ssh and sudo binaries were configured at compile time. SSH will only use PAM if the --with-pam configuration option is specified. Sudo, by default, will be configured to understand shadow password files, but you must use the --with-pam option to get it to understand PAM.

[Michael R. Monteith]

Thanks. We have a group that builds the product for distribution within our company. I notified them of the issue and possible solution. Hopefully this will take care of it. I'll let you know.

Thanks
Michael

[LORI_39]

The openssh-3.6.1p2 binaries were recompiled using the --with-pam option. The user of the secured system can ssh out but not into the system. Any other ideas?

[Steven E. Protter]

Don't use sudo, but I'm a pretty experienced user of ssh.

That being said, I converted my systems to trusted, which if my pea brain molecules still work uses shadowed passwords.

Then I installed ssh and an upgrade.

I had no trouble with authentication at all, and even deployed public keys.

If you go with shadowed passwords and then install the product your results may be different.

SEP

[James A. Donovan · Accepted solution]

On the server that cannot be logged into, you can restart the sshd daemon with the -d option. This will let you get some good diagnostic info, and maybe point to a solution. I believe -dd and -ddd are also available for even more detailed info.

On the client side, you can specify -vvv to give you verbose client connection information as well.

Without more diagnostic info, it's very difficult to say what the solution will be.

[Sridhar Bhaskarla]

I haven't worked on Shadow Password. Reason is that HP trusted systems offer the same feature with other bonuses.

But I worked with both ssh and sudo and both work very well with trusted systems except that ssh has a hiccup with expired passwords. Both can use PAM authentication if they are compiled with it and I believe most of the compilations are that way.

It may be something to do with Shadow Password that itself needs a PAM module to plug in.

-Sri

[LORI_39]

Donovan,
Attached is the response using -ddd on the server side.

It looks like it's not even trying to use PAM anywhere in it.

Michael

[James A. Donovan]

Try downloading HP's version of OpenSSH from http://www.software.hp.com, and use that to test with. If it works, then you know the issue is with your compilation of OpenSSH. If it fails then it's probably a configuration issue on your server.

Can you post the configuration options you used to generate the Makefile?

Has your /etc/pam.conf file been modified?

[Michael R. Monteith]

Well, they got it fixed. The wierd thing is the fix. They ended up recompiling everything. Before they were just recompiling SSH. But when they recompliled zlib and all it worked. Not sure what was wrong in the other packages that did it, but hey, it works.

Thanks
Michael