Red Hat Bugzilla – Bug 163882
cron fails with pam_access
Last modified: 2007-11-30 17:07:19 EST
+++ This bug was initially created as a clone of Bug #146073 +++
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3)
Description of problem:
When using the pam_access module, cron fails for user jobs. In
particular, this shows up in the logs every time the cronjob should run:
pam_access: couldn't get the tty name
crond: Critical error - immediate abort
pam_access is enabled by (for example) adding the following to
account required /lib/security/$ISA/pam_access.so
This causes the rules in /etc/security/access.conf will be enforced.
A google search turned up the issue, along with a possible resolution,
in debian linux: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=254845
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. add "account required /lib/security/$ISA/pam_access.so" to
2. create a cronjob for a user
3. wait ;)
Actual Results: The error is logged in /var/log/messages.
Expected Results: The cronjob should have run.
Fixed for bug 146073 with vixie-cron-4.1-36.EL4
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
* I was under the impression that the bug is really in the pam_access module,
so I was expecting a bugfix for PAM rather than vixie-cron. Is this a cron fix
or a PAM fix?
* This bug applies to RHEL3 also, will there be a bugfix/erratum for RHEL3 too?
RE: Comment #7:
> * I was under the impression that the bug is really in the pam_access module,
> so I was expecting a bugfix for PAM rather than vixie-cron. Is this a cron fix
> or a PAM fix?
No PAM fix was required - crond was not setting the 'PAM_TTY' item, which is
required by the pam_access module.
> * This bug applies to RHEL3 also, will there be a bugfix/erratum for
> RHEL3 too?
No, the latest supported cron for RHEL-3 is vixie-cron-3.0.1-76_EL3, which
has no PAM support.
There is a vixie-cron-4.1 version for RHEL-3, which does have PAM support and
in which this problem is also fixed, available from:
Is there a reason why vixie-cron-4.1-36.EL4 have shipped with pam_access in the
default /etc/pam.d/crond? This does not seem right - if people have a
/etc/security/access.conf set up to something nontrivial, the pam_access in
/etc/pam.d/crond could have very strange effects for them.
P.S. The issue of whether pam_access should tolerate an unset tty is raised in