Bug 143570

Summary:	pam_mkhomedir will not work if privilege separation is enabled openssh
Product:	Red Hat Enterprise Linux 3	Reporter:	Levente Farkas <lfarkas>
Component:	openssh	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	high	Docs Contact:
Priority:	medium
Version:	3.0
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openssh-3.6.1p2-33.30.4	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-06-16 09:16:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Levente Farkas 2004-12-22 14:58:14 UTC

Description of problem:
pam_mkhomedir will not work if privilege separation is enabled
openssh. more detailed description can be found here:
http://www.linuxquestions.org/questions/archive/4/2004/11/4/169325

Version-Release number of selected component (if applicable):
all

How reproducible:
add the following line to system-auth:
session     required      /lib/security/$ISA/pam_mkhomedir.so
skel=/etc/skel-null umask=0077

Steps to Reproduce:
1. ssh as non-root to the host
2.
3.
  
Actual results:
sshd[17977]: fatal: PAM session setup failed[6]: Permission denied

Expected results:
login:-)

Additional info:

Comment 1 Tomas Mraz 2004-12-27 14:41:55 UTC

What package versions you've tested that with?

Comment 2 Levente Farkas 2004-12-27 20:58:01 UTC

on the latest fully updated rhel3

Comment 3 Tomas Mraz 2004-12-28 08:31:40 UTC

So why do you report it on FC devel?

There is nothing pam_mkhomedir can do with the problem. You must
disable privilege separation.

However the newest openssh (FC3, RHEL4) doesn't exhibit this problem.

Comment 4 Levente Farkas 2004-12-28 10:20:48 UTC

sorry about that:-( i'd like to report it on rhel. anyway i don't
think so the solution is to disable privilege separation! rather then
fix it at the ssh level even in the next rhel 3 updates.
yours.

Comment 5 Tomas Mraz 2005-02-10 10:07:36 UTC

Try packages from http://people.redhat.com/tmraz/testing/ which should
fix the problem. 
Of course they are unofficial so the standard disclaimers apply. They
aren't guaranteed to work and they can eat your data or even computer.

Comment 6 Tomas Mraz 2005-06-16 09:16:45 UTC

Should be fixed with the latest errata.