Red Hat Bugzilla – Bug 201343
pam_securetty requires known user to work
Last modified: 2007-11-30 17:07:32 EST
Description of problem: pam modules may change the username as part of the processing. Login needs to switch to that new user name. This can be seen by logging in using smart cards. Version-Release number of selected component (if applicable): FC6 Test 2, rawhide How reproducible: 1. Enable Smart Card login. 2. switch to a login screen 3. insert your smart card, hit ' '<enter> 4. Supply your pin pam_pkcs11 will authenticate you, but your login fails. If you type your matching user name at step 3 you will be logged in. The same stack succeeds in gdm. NOTE: The initial symptoms point to a bug in login, however the problem could be in pam_pkcs11 as instead. bob
I think that login - same as many other PAM client apps (openssh for example) - simply doesn't request the new username from PAM when it is called.
right, that's what we figured the bug was, too.
Bob, I need more details about "...but your login fails". What do you have in logs? Is there any error message from login? I need a clue when login process failed.
So actually the problem is caused by pam_securetty (which is in pam config for login). It is configured as a first PAM module to call and it requires a known user to work. This can be fixed calling pam_securetty like this: auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
Tom, is it right use this setting also for "remote" login? Now we use same configuration for remote and for local login.
I think that it should be left as is for remote login if it doesn't complicate things too much for you.
Reopening based on comment 7.
Fixed in util-linux >= 2.13-0.40.
1. Switch to a login screen. 2. Insert your smart card. 3. Type ' '<enter> (that is hit the space bar and enter key). 4. You should be prompted with your smart card password. type it. 5. You should be logged in as you. bob
Closing as the fixes are included in the latest RHEL5 trees (20061111.0)