Bug 164794

Summary:	su does not work as expected when kerberos authentication is enabled
Product:	Red Hat Enterprise Linux 4	Reporter:	Andre ten Bohmer <andre.tenbohmer>
Component:	pam_krb5	Assignee:	Nalin Dahyabhai <nalin>
Status:	CLOSED ERRATA	QA Contact:	Brian Brock <bbrock>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0	CC:	akananov, benl, mark, shillman, tmraz, twaugh
Target Milestone:	---	Keywords:	FutureFeature
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	2.1.8	Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-08-14 16:07:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	179133

Description Andre ten Bohmer 2005-08-01 14:55:45 UTC

Description of problem:
Running Red Hat Enterprise Linux AS release 4 (Nahant Update 1) using kerberos
authentication against Microsoft Active directory, seems to been broken compared
to previous Red Hat releases (like AS3 U5) regarding the use of su as root. If I
logon with root (console or via ssh), I'm not able to su to a "normal" local
user account :
]# su - guest1
su: incorrect password

Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux AS release 4 (Nahant Update 1)
coreutils-5.2.1-31.1

How reproducible:
Logon as root via SSH or console, perform su for a local account like guest1

Actual results:
Su does not ask for a password and despite "minimum_uid = 500" in the krb5.conf
file (user guest1 has uid 504), "it" contacts the MS-AD servers trying to
authenticate the user without asking for a password.
I've disabled SE-Linux to rule out problems from that side, but to no avail.
Comparing the /etc/pam.d/su file with the one on a AS3-U5 server reveals leads,
except for the extra pam_selinux.so lines.

When disabling kerberos authentication, via authconfig, su works like a charm,
no password needed like expected.

Expected results:
A local user shell for guest1 or otherwise a apropriate error message

Additional info:
Enabling "Local authorization is sufficient" via authconfig, enables su for root
on local accounts while kerberos authentication is enabled

Comment 2 Tim Waugh 2005-08-02 12:32:34 UTC

Changing component and reassigning.

Comment 4 Mark Bober 2005-10-19 17:26:43 UTC

This also affects cronjobs, as I reported in Bug #144064. That was reported on
FC3, which is more-or-less RHEL 4.

Comment 5 Tomas Mraz 2006-01-27 17:06:28 UTC

Simplest workaround for this problem and potentially other account modules'
problems is to put 'account sufficient pam_succeed_if.so use_uid uid eq 0' into
the /etc/pam.d/su and /etc/pam.d/crond.

Comment 6 Nalin Dahyabhai 2007-05-03 17:37:05 UTC

This should be fixed in 2.1.8 and later.

Comment 7 Nalin Dahyabhai 2007-05-03 17:37:51 UTC

*** Bug 230464 has been marked as a duplicate of this bug. ***

Comment 14 Nalin Dahyabhai 2007-08-14 16:07:51 UTC

Just verified that we did include this in update 2.  Marking as closed, current
release.