Não é possível alterar a senha do Kerberos com passwd

Question

Eu configurei uma autenticação comum do kerberos para o meu domínio. Depois disso, está funcionando bem sem problemas. Mas um usuário não pode alterar a senha usando o comando Linux. Na análise sobre isso, recebi o erro abaixo em /var/log/auth.log :

bharathi passwd[3715]: pam_unix(passwd:chauthtok): authentication failure; logname=test uid=1000 euid=0 tty= ruser= rhost= user=test

Resposta do Kerberos Admin Server.

May 11 16:44:48 bharathi krb5kdc[28795](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.27.50: NEEDED_PREAUTH: [email protected] for kadmin/[email protected], Additional pre-authentication required
May 11 16:44:48 bharathi krb5kdc[28795](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.27.50: ISSUE: authtime 1368270888, etypes {rep=18 tkt=18 ses=18}, [email protected] for kadmin/[email protected]
May 11 16:45:07 bharathi krb5kdc[28795](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.27.50: NEEDED_PREAUTH: [email protected] for kadmin/[email protected], Additional pre-authentication required
May 11 16:45:07 bharathi krb5kdc[28795](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.27.50: ISSUE: authtime 1368270907, etypes {rep=18 tkt=18 ses=18}, [email protected] for kadmin/[email protected]

Resposta do servidor admin kerberos parece estar bem. Eu suspeito que o problema esteja na configuração pam.d .

common-auth

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

auth    sufficient  pam_krb5.so minimum_uid=1000

# here are the per-package modules (the "Primary" block)
auth    [success=3 default=ignore]  pam_krb5.so minimum_uid=1000
auth    [success=2 default=ignore]  pam_unix.so nullok_secure try_first_pass
auth    [success=1 default=ignore]  pam_lsass.so try_first_pass
# here's the fallback if no module succeeds
auth    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

conta comum

    #
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.
#

account required            pam_krb5.so minimum_uid=1000

# here are the per-package modules (the "Primary" block)
account [success=3 new_authtok_reqd=done default=ignore]    pam_unix.so 
account [success=ok new_authtok_reqd=ok default=ignore]     pam_lsass.so unknown_ok
account [success=1 new_authtok_reqd=done default=ignore]    pam_lsass.so 
# here's the fallback if no module succeeds
account requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
account required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config

senha comum

    #
# /etc/pam.d/common-password - password-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define the services to be
# used to change user passwords.  The default is pam_unix.

# Explanation of pam_unix options:
#
# The "sha512" option enables salted SHA512 passwords.  Without this option,
# the default is Unix crypt.  Prior releases used the option "md5".
#
# The "obscure" option replaces the old 'OBSCURE_CHECKS_ENAB' option in
# login.defs.
#
# See the pam_unix manpage for other options.

# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
password    requisite           pam_krb5.so minimum_uid=1000
password    [success=2 default=ignore]  pam_unix.so obscure use_authtok try_first_pass sha512
password    [success=1 default=ignore]  pam_lsass.so use_authtok try_first_pass
# here's the fallback if no module succeeds
password    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
password    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
password    optional    pam_gnome_keyring.so 
# end of pam-auth-update config

O que estou fazendo de errado aqui?

    

Answer 1

Seu auth.log contém a seguinte dica:

bharathi passwd[3715]: pam_unix(passwd:chauthtok): authentication failure; logname=test uid=1000 euid=0 tty= ruser= rhost= user=test

Olhando para a senha comum, as linhas relevantes são:

password requisite pam_krb5.so minimum_uid=1000

O módulo Kerberos-PAM lidará apenas com usuários com uid > = 1000, o que é bom para manter contas locais como root funcionando mesmo quando a rede falha.

O requisito marca este módulo como sempre necessário, portanto, neste caso sucesso é armazenado como resultado, mas os seguintes módulos ainda são executados.

password [success=2 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512

O próximo módulo é o módulo unix com falha, que agora tenta alterar a senha em /etc/shadow . Mas como esse é um usuário do Kerberos, provavelmente não há entrada em /etc/shadow . Devido ao ignore , esta falha é ignorada: o erro ainda é registrado, mas o resultado para a pilha PAM não é alterado.

Mas o próximo módulo segue:

password requisite pam_deny.so

Isso finalmente sobrescreverá o código de resultado anterior com deny e, portanto, negará a solicitação para alterar a senha.

Se for suficiente apenas alterar a senha do Kerbers, altere o requisito para o Kerberos em [success = 3 default = ignore] , o que ignoraria os próximos 3 módulos ( unix, lsass, deny) no sucesso e assim continuar com o pam_permit.so , que força a stack a finalmente retornar o sucesso.

Se, por outro lado, você tiver usuários com ambas as entradas / etc / shadow e no Kerberos, e quiser manter essas duas senhas sincronizadas, fica muito mais complicado acertar . Algo como seguir deve funcionar:

1. Primeiro, tente alterar a senha do Kerberos.
2. Se isso for bem-sucedido, tente opcionalmente também alterar a senha local do Unix em /etc/shadow .

3. Caso contrário, require a alteração da senha do Unix será bem-sucedida.

   password [success=3 user_unknown=ignore default=ignore] pam_krb5.so minimum_uid=1000
   password [success=3 default=ignore] pam_unix.so obscure use_authtok try_first_pass sha512
   password [success=2 default=ignore] pam_lsass.so use_authtok try_first_pass
   password requisite           pam_deny.so
   password [success=ok default=ignore] pam_unix.so obscure use_authtok use_first_pass sha512
   password required            pam_permit.so