Bug 201343

Summary:	pam_securetty requires known user to work
Product:	Red Hat Enterprise Linux 5	Reporter:	Bob Relyea <rrelyea>
Component:	util-linux	Assignee:	Karel Zak <kzak>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Ben Levenson <benl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.0	CC:	rrelyea, rstrode, tmraz
Target Milestone:	---	Keywords:	Reopened
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	5.0.0	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-11-13 15:35:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	181386, 181509

Description Bob Relyea 2006-08-04 15:08:05 UTC

Description of problem:

pam modules may change the username as part of the processing. Login needs to
switch to that new user name.

This can be seen by logging in using smart cards.

Version-Release number of selected component (if applicable):

FC6 Test 2, rawhide

How reproducible:

1. Enable Smart Card login.
2. switch to a login screen
3. insert your smart card, hit ' '<enter>
4. Supply your pin

pam_pkcs11 will authenticate you, but your login fails.
If you type your matching user name at step 3 you will be logged in.

The same stack succeeds in gdm.

NOTE: The initial symptoms point to a bug in login, however the problem could be
in pam_pkcs11 as instead.

bob

Comment 1 Tomas Mraz 2006-08-09 17:45:16 UTC

I think that login - same as many other PAM client apps (openssh for example) -
simply doesn't request the new username from PAM when it is called.

Comment 2 Ray Strode [halfline] 2006-08-09 17:52:05 UTC

right, that's what we figured the bug was, too.

Comment 3 Karel Zak 2006-08-10 10:02:22 UTC

Bob, I need more details about "...but your login fails". What do you have in
logs? Is there any error message from login? I need a clue when login process
failed.

Comment 4 Tomas Mraz 2006-08-10 11:35:19 UTC

So actually the problem is caused by pam_securetty (which is in pam config for
login). It is configured as a first PAM module to call and it requires a known
user to work.

This can be fixed calling pam_securetty like this:

auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so

Comment 5 Karel Zak 2006-08-11 06:09:40 UTC

Tom, is it right use this setting also for "remote" login? Now we use same
configuration for remote and for local login.

Comment 6 Tomas Mraz 2006-08-21 07:58:27 UTC

I think that it should be left as is for remote login if it doesn't complicate
things too much for you.

Comment 10 Jay Turner 2006-09-22 03:38:02 UTC

Reopening based on comment 7.

Comment 11 Karel Zak 2006-09-22 06:54:50 UTC

Fixed in util-linux >= 2.13-0.40.

Comment 13 Bob Relyea 2006-09-26 18:09:17 UTC

1. Switch to a login screen.
2. Insert your smart card.
3. Type ' '<enter> (that is hit the space bar and enter key).
4. You should be prompted with your smart card password. type it.
5. You should be logged in as you.

bob

Comment 15 Jay Turner 2006-11-13 15:35:00 UTC

Closing as the fixes are included in the latest RHEL5 trees (20061111.0)