Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1rVHEY-00Fx9g-5P for pgsql-admin@arkaria.postgresql.org; Wed, 31 Jan 2024 20:30:58 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1rVHDW-00GWBj-9Y for pgsql-admin@arkaria.postgresql.org; Wed, 31 Jan 2024 20:29:54 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1rVHDV-00GWBb-GW for pgsql-admin@lists.postgresql.org; Wed, 31 Jan 2024 20:29:53 +0000 Received: from mail-4317.proton.ch ([185.70.43.17]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1rVHDR-004m1S-6y for pgsql-admin@lists.postgresql.org; Wed, 31 Jan 2024 20:29:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aag.sh; s=protonmail; t=1706732985; x=1706992185; bh=g8RH/X8BDr7FmV4IbSYg3K+Geigu7gTU35NT99oDG78=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector; b=Gnr0JVAfxfQwzil64ntMhSJlK35SO6MVTVsRmsxPjdMmalb59OZdP5iSX66NPk8H8 w2SLHItIcdudKyasHsBADTqWMGXvwW/WZcZo8D2QEwLhSLkEl4r8I6fMqx2E7kpyc4 bdN2lRfVEteDpL8+Wjlj5+DgtGYfItHGFMcPwLqc= Date: Wed, 31 Jan 2024 20:29:31 +0000 To: Samed YILDIRIM From: Andrey Glazunov Cc: pgsql-admin@lists.postgresql.org Subject: Re: Pam NIS authentication Message-ID: <4850ec5b-96d9-42a6-8064-9c35b5b315ec@aag.sh> In-Reply-To: References: <4a2aee3e-71a9-4542-98c3-2d0bdb8eb72a@aag.sh> Feedback-ID: 12001544:user:proton MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk Hi Samed, I just tried dropping account mechanism to pam_permit as you suggested and = unfortunately it did not help. There is an acl on shadow file so it readable by postgres user. And an empty or wrong password is an auth failure as expected. /etc/nsswitch.conf was generated by authselect: aliases: files nis automount: files nis ethers: files nis group: files nis systemd hosts: files nis dns myhostname initgroups: files nis netgroup: files nis networks: files nis passwd: files nis systemd protocols: files nis publickey: files nis rpc: files nis services: files nis shadow: files nis gshadow: files Looks okay to me. I can lookup, login or switch NIS users without issue, so= I assume the setup is correct. One tring that comes to mind is that our NIS uids are somewhat big, startin= g around 50k. Could this be an issue? thanks, wbr, Andrey On 31/01/2024 19:46, Samed YILDIRIM wrote: > Hi Andrey, >=20 > I haven't used Postgres with pam authentication for a long time. I cannot= spot anything right away. However, your "All of this works fine for 'local= ' Linux accounts." sentence makes me confused. According to what I understa= nd from the documentation and your explanation, it is not supposed to work. >=20 >=20 > Note >=20 > If PAM is set up to read |/etc/shadow|, authentication will fail because = the PostgreSQL server is started by a non-root user. However, this is not a= n issue when PAM is configured to use LDAP or other authentication methods. >=20 > https://www.postgresql.org/docs/15/auth-pam.html >=20 > Have you tried to run pamtester as postgres user? Also testing with an em= pty password and with a wrong password may be helpful. >=20 > Also, what does the /etc/nsswitch.conf file look like? There can be a con= figuration issue in that file. Following log line looks interesting. My fir= st impression is that it could not find the user. Do you use the same users= to log in the Linux server itself? > [566]: psql 10.65.31.25(40004) authentication: pam_unix(postgres= ql:auth): check pass; user unknown >=20 > My gut says the passwd line is not configured correctly in the nsswitch.c= onf file. And, you may end up with changing the account line in the /etc/pa= m.d/postgresql file with the line below. > account required pam_permit.so >=20 > Best regards. > Samed YILDIRIM >=20 >=20 > On Wed, 31 Jan 2024 at 19:08, Andrey Glazunov > wrote: >=20 > Hi, >=20 > I'm trying to configure Postgres to authenticate NIS users through pa= m. >=20 > Here is my setup: >=20 > Server version: > PostgreSQL 15.2 on x86_64-redhat-linux-gnu, compiled by gcc (GCC) 8.5= .0 20210514 (Red Hat 8.5.0-18), 64-bit >=20 > Relevant pg_hba lines: > host=C2=A0 =C2=A0 all=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0psql=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 all=C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0md5 > host=C2=A0 =C2=A0 all=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0all=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0all=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam >=20 > PAM: > /etc/pam.d/postgresql > #%PAM-1.0 > auth=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 include=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0password-auth > account=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0include=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0password-auth >=20 > /etc/pam.d/password-auth > # Generated by authselect on Wed Jan 31 12:48:13 2024 > # Do not modify this file manually. >=20 > auth=C2=A0 =C2=A0 =C2=A0 =C2=A0 required=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_env.so > auth=C2=A0 =C2=A0 =C2=A0 =C2=A0 required=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_faildelay.so delay=3D2000000 > auth=C2=A0 =C2=A0 =C2=A0 =C2=A0 sufficient=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_unix.so nullok > auth=C2=A0 =C2=A0 =C2=A0 =C2=A0 required=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_deny.so >=20 > account=C2=A0 =C2=A0 =C2=A0required=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_unix.so broken_shadow >=20 > password=C2=A0 =C2=A0 requisite=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 pam_pwquality.so local_users_only > password=C2=A0 =C2=A0 sufficient=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0pam_unix.so sha512 shadow nullok use_authtok nis > password=C2=A0 =C2=A0 required=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_deny.so >=20 > session=C2=A0 =C2=A0 =C2=A0optional=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_keyinit.so revoke > session=C2=A0 =C2=A0 =C2=A0required=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_limits.so > -session=C2=A0 =C2=A0 optional=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_systemd.so > session=C2=A0 =C2=A0 =C2=A0[success=3D1 default=3Dignore]=C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_succeed_i= f.so service in crond quiet use_uid > session=C2=A0 =C2=A0 =C2=A0required=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam_unix.so >=20 > Pam service seems to be okay, ie if I provide the correct pass, it le= ts me through with both local and NIS accounts: > % pamtester -v postgresql authenticate > pamtester: invoking pam_start(postgresql, , ...) > pamtester: performing operation - authenticate > Password: > pamtester: successfully authenticated >=20 > % pamtester -v postgresql authenticate > pamtester: invoking pam_start(postgresql, , ...) > pamtester: performing operation - authenticate > Password: > pamtester: successfully authenticated >=20 >=20 > Users exist in Postgres with login permission, required NIS daemons a= re up and running, tools like ypwhich or ypcat are working fine. > But when I try to connect to Postgres server using NIS account, authe= ntication fails: > psql: error: connection to server at "" (10.65.31.25), port= 5432 failed: FATAL:=C2=A0 PAM authentication failed for user "" >=20 > Server logs: > [52] DEBUG:=C2=A0 forked new backend, pid=3D564 socket=3D10 > [564] DEBUG:=C2=A0 InitPostgres > [564] DEBUG:=C2=A0 my backend ID is 3 > [564] DEBUG:=C2=A0 StartTransaction(1) name: unnamed; blockState: DEF= AULT; state: INPROGRESS, xid/subid/cid: 0/1/0 > [564] DEBUG:=C2=A0 shmem_exit(0): 4 before_shmem_exit callbacks to ma= ke > [564] DEBUG:=C2=A0 shmem_exit(0): 6 on_shmem_exit callbacks to make > [564] DEBUG:=C2=A0 proc_exit(0): 2 callbacks to make > [564] DEBUG:=C2=A0 exit(0) > [564] DEBUG:=C2=A0 shmem_exit(-1): 0 before_shmem_exit callbacks to m= ake > [564] DEBUG:=C2=A0 shmem_exit(-1): 0 on_shmem_exit callbacks to make > [564] DEBUG:=C2=A0 proc_exit(-1): 0 callbacks to make > [52] DEBUG:=C2=A0 reaping dead processes > [52] DEBUG:=C2=A0 server process (PID 564) exited with exit code 0 > [52] DEBUG:=C2=A0 forked new backend, pid=3D566 socket=3D10 > [566] DEBUG:=C2=A0 InitPostgres > [566] DEBUG:=C2=A0 my backend ID is 3 > [566] DEBUG:=C2=A0 StartTransaction(1) name: unnamed; blockState: DEF= AULT; state: INPROGRESS, xid/subid/cid: 0/1/0 > [566] DEBUG:=C2=A0 received password packet > [566] LOG:=C2=A0 pam_authenticate failed: Authentication failure > [566] FATAL:=C2=A0 PAM authentication failed for user "" > [566] DETAIL:=C2=A0 Connection matched pg_hba.conf line 105: "host= =C2=A0 =C2=A0 all=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0all=C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0all=C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pam" > [566] DEBUG:=C2=A0 shmem_exit(1): 4 before_shmem_exit callbacks to ma= ke > [566] DEBUG:=C2=A0 shmem_exit(1): 6 on_shmem_exit callbacks to make > [566] DEBUG:=C2=A0 proc_exit(1): 2 callbacks to make > [566] DEBUG:=C2=A0 exit(1) > [566] DEBUG:=C2=A0 shmem_exit(-1): 0 before_shmem_exit callbacks to m= ake > [566] DEBUG:=C2=A0 shmem_exit(-1): 0 on_shmem_exit callbacks to make > [566] DEBUG:=C2=A0 proc_exit(-1): 0 callbacks to make > [52] DEBUG:=C2=A0 reaping dead processes > [52] DEBUG:=C2=A0 server process (PID 566) exited with exit code 1 >=20 > Secure log: > [564]: psql 10.65.31.25(39990) authentication: pam_unix(post= gresql:auth): username [] obtained > [564]: psql 10.65.31.25(39990) authentication: pam_unix(post= gresql:auth): conversation failed > [564]: psql 10.65.31.25(39990) authentication: pam_unix(post= gresql:auth): auth could not identify password for [] > [566]: psql 10.65.31.25(40004) authentication: pam_unix(post= gresql:auth): username [] obtained > [566]: psql 10.65.31.25(40004) authentication: pam_unix(post= gresql:auth): check pass; user unknown > [566]: psql 10.65.31.25(40004) authentication: pam_unix(post= gresql:auth): authentication failure; logname=3D uid=3D26 euid=3D26 tty=3D = ruser=3D rhost=3D10.65.31.25 >=20 > All of this works fine for 'local' Linux accounts. >=20 > Am I missing something? >=20 > thanks, >=20 > --=20 > wbr, > =C2=A0 =C2=A0Andrey >=20 >=20 >=20