+++ This bug was initially created as a clone of Bug #146073 +++ From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.3) Gecko/20041020 Description of problem: When using the pam_access module, cron fails for user jobs. In particular, this shows up in the logs every time the cronjob should run: pam_access[6093]: couldn't get the tty name crond[6093]: Critical error - immediate abort pam_access is enabled by (for example) adding the following to /etc/pam.d/system_auth: account required /lib/security/$ISA/pam_access.so This causes the rules in /etc/security/access.conf will be enforced. A google search turned up the issue, along with a possible resolution, in debian linux: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=254845 Version-Release number of selected component (if applicable): vixie-cron-4.1-20_FC3 How reproducible: Always Steps to Reproduce: 1. add "account required /lib/security/$ISA/pam_access.so" to /etc/pam.d/system_auth 2. create a cronjob for a user 3. wait ;) Actual Results: The error is logged in /var/log/messages. Expected Results: The cronjob should have run. Additional info:
Fixed for bug 146073 with vixie-cron-4.1-36.EL4
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2005-361.html
2 questions: * I was under the impression that the bug is really in the pam_access module, so I was expecting a bugfix for PAM rather than vixie-cron. Is this a cron fix or a PAM fix? * This bug applies to RHEL3 also, will there be a bugfix/erratum for RHEL3 too?
RE: Comment #7: > * I was under the impression that the bug is really in the pam_access module, > so I was expecting a bugfix for PAM rather than vixie-cron. Is this a cron fix > or a PAM fix? No PAM fix was required - crond was not setting the 'PAM_TTY' item, which is required by the pam_access module. > * This bug applies to RHEL3 also, will there be a bugfix/erratum for > RHEL3 too? No, the latest supported cron for RHEL-3 is vixie-cron-3.0.1-76_EL3, which has no PAM support. There is a vixie-cron-4.1 version for RHEL-3, which does have PAM support and in which this problem is also fixed, available from: http://people.redhat.com/~jvdias/cron/RHEL-3/4.1-8.EL3
Is there a reason why vixie-cron-4.1-36.EL4 have shipped with pam_access in the default /etc/pam.d/crond? This does not seem right - if people have a /etc/security/access.conf set up to something nontrivial, the pam_access in /etc/pam.d/crond could have very strange effects for them. P.S. The issue of whether pam_access should tolerate an unset tty is raised in bug 170467.