I need to prevent users from authenticating through Kerberos when the encrypted /home/users has not yet been mounted. (This is to avoid corrupting the ecryptfs mountpoint)

Currently I have these lines in /etc/pam.d/common-auth:

auth    required                        pam_group.so use_first_pass
auth    [success=2 default=ignore]      pam_krb5.so minimum_uid=1000 try_first_pass
auth    [success=1 default=ignore]      pam_unix.so nullok_secure try_first_pass

I am planning to use pam_exec.so to execute a script that will exit 1 if the ecyptfs mounts are not ready yet.

Doing this:

auth    required        pam_exec.so     /etc/security/check_ecryptfs

will lock me out for good if ecryptfs for some reason fails. In such case I would like to at least be able to login with a local (non-kerberos) user to fix the issue.

Is there some sort of AND-Operator in which I can say that login through kerberos+ldap is only sufficient if both kerberos authentication and the ecryptfs mount has succeeded?

  • There isn't a good solution to the stated problem that involves the use of PAM modules, because PAM is an authentication framework. Ensuring the availability of file systems isn't (and shouldn't be) the authentication framework's concern. A better approach would be to use existing startup sequence tools like init.d or Upstart scripts to guarantee the required file systems are available before users are presented with a login prompt. – cqcallaw Apr 6 '12 at 21:49
  • @CalebCallaway users login with SSH. It is a headless server. I do agree that strictly it shouldn't be PAM's concern, but the same applies to pam mkhomedir and ecryptfs itself really. – d_inevitable Apr 6 '12 at 23:40

I'm not aware of any AND operator for PAM, but you can achieve the same effect with control statements. Per my comment, this is pretty hacky, but should get the job done.

In your check script, return a specific PAM error code (probably PAM_SYSTEM_ERR), then use control statements in your common-auth file like so:

auth    required                        pam_group.so use_first_pass
auth    [success=ok default=1]          pam_exec.so /etc/security/check_ecryptfs
auth    [success=2 default=ignore]      pam_krb5.so minimum_uid=1000 try_first_pass
auth    [success=1 default=ignore]      pam_unix.so nullok_secure try_first_pass

The control statements for the pam_exec module should cause PAM to go to the next module (pam_krb5) on success, and skip to pam_unix if pam_exe returns any other return code. You'll need to make sure your module actually returns the success code, though. See the source.

Further reference:

  • Thank you, I will try that now. exit 4 when ecryptfs is not moutned and exit 0 when it is mounted. – d_inevitable Apr 7 '12 at 18:22
  • Ok it is not working for some reason. Seems like pam_unix is for some reason letting kerberos users through. Any idea why this could be? I have commented out the krb5 line altogether, still able to login. – d_inevitable Apr 7 '12 at 18:42
  • Ok I think it is because pam is bypassed by sshd when a kerberos ticket is delegated. – d_inevitable Apr 7 '12 at 18:47
  • You answer works as far as my question is concerned. But for some reason ssh bypasses PAM when a kerberos ticket is presented and therefore this brick does not solve the problem that I was trying to solve. But that not the fault of your answer, so I have accepted it. – d_inevitable Apr 7 '12 at 20:00
  • Thanks for the accept :) sshd may use a different method, but I'm reasonably sure it does use PAM--see for instance /etc/pam.d/sshd. You might check the log /var/log/auth.log to see how the authentication is being handled. Most PAM modules also have a debug argument that can provide further information about how they process authentication requests. – cqcallaw Apr 8 '12 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.