From: Andrey Glazunov <aag@aag.sh>
To: pgsql-admin@lists.postgresql.org
Subject: Pam NIS authentication
Date: Wed, 31 Jan 2024 17:08:27 +0000
Message-ID: <4a2aee3e-71a9-4542-98c3-2d0bdb8eb72a@aag.sh> (raw)
Hi,
I'm trying to configure Postgres to authenticate NIS users through pam.
Here is my setup:
Server version:
PostgreSQL 15.2 on x86_64-redhat-linux-gnu, compiled by gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-18), 64-bit
Relevant pg_hba lines:
host all psql all md5
host all all all pam
PAM:
/etc/pam.d/postgresql
#%PAM-1.0
auth include password-auth
account include password-auth
/etc/pam.d/password-auth
# Generated by authselect on Wed Jan 31 12:48:13 2024
# Do not modify this file manually.
auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_unix.so nullok
auth required pam_deny.so
account required pam_unix.so broken_shadow
password requisite pam_pwquality.so local_users_only
password sufficient pam_unix.so sha512 shadow nullok use_authtok nis
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
Pam service seems to be okay, ie if I provide the correct pass, it lets me through with both local and NIS accounts:
% pamtester -v postgresql <localuser> authenticate
pamtester: invoking pam_start(postgresql, <localuser>, ...)
pamtester: performing operation - authenticate
Password:
pamtester: successfully authenticated
% pamtester -v postgresql <nisuser> authenticate
pamtester: invoking pam_start(postgresql, <nisuser>, ...)
pamtester: performing operation - authenticate
Password:
pamtester: successfully authenticated
Users exist in Postgres with login permission, required NIS daemons are up and running, tools like ypwhich or ypcat are working fine.
But when I try to connect to Postgres server using NIS account, authentication fails:
psql: error: connection to server at "<hostname>" (10.65.31.25), port 5432 failed: FATAL: PAM authentication failed for user "<nisuser>"
Server logs:
[52] DEBUG: forked new backend, pid=564 socket=10
[564] DEBUG: InitPostgres
[564] DEBUG: my backend ID is 3
[564] DEBUG: StartTransaction(1) name: unnamed; blockState: DEFAULT; state: INPROGRESS, xid/subid/cid: 0/1/0
[564] DEBUG: shmem_exit(0): 4 before_shmem_exit callbacks to make
[564] DEBUG: shmem_exit(0): 6 on_shmem_exit callbacks to make
[564] DEBUG: proc_exit(0): 2 callbacks to make
[564] DEBUG: exit(0)
[564] DEBUG: shmem_exit(-1): 0 before_shmem_exit callbacks to make
[564] DEBUG: shmem_exit(-1): 0 on_shmem_exit callbacks to make
[564] DEBUG: proc_exit(-1): 0 callbacks to make
[52] DEBUG: reaping dead processes
[52] DEBUG: server process (PID 564) exited with exit code 0
[52] DEBUG: forked new backend, pid=566 socket=10
[566] DEBUG: InitPostgres
[566] DEBUG: my backend ID is 3
[566] DEBUG: StartTransaction(1) name: unnamed; blockState: DEFAULT; state: INPROGRESS, xid/subid/cid: 0/1/0
[566] DEBUG: received password packet
[566] LOG: pam_authenticate failed: Authentication failure
[566] FATAL: PAM authentication failed for user "<nisuser>"
[566] DETAIL: Connection matched pg_hba.conf line 105: "host all all all pam"
[566] DEBUG: shmem_exit(1): 4 before_shmem_exit callbacks to make
[566] DEBUG: shmem_exit(1): 6 on_shmem_exit callbacks to make
[566] DEBUG: proc_exit(1): 2 callbacks to make
[566] DEBUG: exit(1)
[566] DEBUG: shmem_exit(-1): 0 before_shmem_exit callbacks to make
[566] DEBUG: shmem_exit(-1): 0 on_shmem_exit callbacks to make
[566] DEBUG: proc_exit(-1): 0 callbacks to make
[52] DEBUG: reaping dead processes
[52] DEBUG: server process (PID 566) exited with exit code 1
Secure log:
<nisuser>[564]: psql 10.65.31.25(39990) authentication: pam_unix(postgresql:auth): username [<nisuser>] obtained
<nisuser>[564]: psql 10.65.31.25(39990) authentication: pam_unix(postgresql:auth): conversation failed
<nisuser>[564]: psql 10.65.31.25(39990) authentication: pam_unix(postgresql:auth): auth could not identify password for [<nisuser>]
<nisuser>[566]: psql 10.65.31.25(40004) authentication: pam_unix(postgresql:auth): username [<nisuser>] obtained
<nisuser>[566]: psql 10.65.31.25(40004) authentication: pam_unix(postgresql:auth): check pass; user unknown
<nisuser>[566]: psql 10.65.31.25(40004) authentication: pam_unix(postgresql:auth): authentication failure; logname= uid=26 euid=26 tty= ruser= rhost=10.65.31.25
All of this works fine for 'local' Linux accounts.
Am I missing something?
thanks,
--
wbr,
Andrey
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: aag@aag.sh, pgsql-admin@lists.postgresql.org
Subject: Re: Pam NIS authentication
In-Reply-To: <4a2aee3e-71a9-4542-98c3-2d0bdb8eb72a@aag.sh>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox