Suprima log estranho de "falha de autenticação" ao usar o pam_ldap com ssh no CentOS 7

Question

Nós instalamos com sucesso o daemon ssh com autenticação LDAP no CentOS 7.

Mas há mensagens de log estranhas em / var / log / secure, mesmo que o usuário faça login com sucesso (primeira linha):

Dec  5 08:28:13 HOSTNAME.SERVER sshd[11195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=HOSTNAME.CLIENT  user=USERNAME
Dec  5 08:28:13 HOSTNAME.SERVER sshd[11195]: Accepted password for USERNAME from IP.CLIENT port 25423 ssh2
Dec  5 08:28:13 HOSTNAME.SERVER sshd[11195]: pam_unix(sshd:session): session opened for user USERNAME by (uid=0)

Como podemos suprimir o registro de "falha de autenticação"?

Aqui estão os nossos arquivos de configuração que supomos estar relacionados:

/etc/pam.d/system-auth-ac

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     optional      pam_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

/etc/pam.d/password-auth-ac

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 1000 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
-session     optional      pam_systemd.so
session     optional      pam_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

    

Answer 1

De acordo com o artigo da Red Hat, 881103

This is expected behaviour from pam_unix and the message is normal and harmless.

There is no configuration option within pam_unix to stop logging those messages.

The default pam configuration tries to authenticate a user using pam_unix first, then using pam_ldap.so module if authentication with pam_unix is failed.

O artigo também mostrará uma possível alteração de configuração se você quiser remover esses erros de falhas padrão do registro.