Bug 153208

Summary: pam_tally broken in pam-0.79-1
Product: [Fedora] Fedora Reporter: Thomas Zehetbauer <thomasz>
Component: pamAssignee: Tomas Mraz <tmraz>
Status: CLOSED RAWHIDE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: rawhide   
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: pam-0.79-2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-04-03 17:15:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Thomas Zehetbauer 2005-04-03 01:41:29 UTC 
I could no longer login/su after updating to pam-0.79-1

/etc/pam.d/system-auth contained:
  auth        optional      pam_tally.so no_magic_root
  account     required      pam_tally.so deny=5 no_magic_root
causes the following to be logged
  pam_tally: unknown option; no_magic_root
  pam_tally: option deny=5 allowed in auth phase only
  pam_tally: unknown option; no_magic_root
  su(pam_unix)[16773]: session opened for user root by thomasz(uid=500)
  pam_tally: unknown option; no_magic_root
  kernel: su[16774]: segfault at 0000000000000000 rip 00002aaaadfbb530 rsp
00007ffffffff450 error 4
and with the options removed:
  su(pam_unix)[17007]: session opened for user root by thomasz(uid=500)
  su(pam_unix)[17007]: session closed for user root
  kernel: su[17008]: segfault at 0000000000000000 rip 00002aaaadfbb530 rsp
00007ffffffff450 error 4
Comment 1 Tomas Mraz 2005-04-03 16:31:17 UTC 
The pam_tally module is redesigned in pam-0.79. This redesign was necessary to
fix bug 60930.

So you need to rearrange the options according to the README.pam_tally provided
with the package.

However su shouldn't segfault. So could you please attach your
/etc/pam.d/system-auth and /etc/pam.d/su here and also could you please try to
obtain a backtrace from the crashing su binary?
Comment 2 Tomas Mraz 2005-04-03 17:15:54 UTC 
Actually it's not necessary anymore - I know where the bug is. Upgrade to
pam-0.79-2 when it's available. However you will need to rearrange the options
anyway.