Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 56027 - pam authentication fails
pam authentication fails
Status: CLOSED RAWHIDE
Product: Red Hat Linux
Classification: Retired
Component: squid (Show other bugs)
7.2
i586 Linux
medium Severity medium
: ---
: ---
Assigned To: Martin Stransky
:
Depends On:
Blocks:
  Show dependency tree / graph
 
Reported: 2001-11-11 01:33 EST by Matt Swanson
Modified: 2007-04-18 12:38 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-07-07 06:40:18 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Matt Swanson 2001-11-11 01:33:59 EST 
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.2.1) Gecko/20010901

Description of problem:
When running /usr/lib/squid/pam_auth only the first person to authenticate
can use squid. All future requests from all other users fail. Exiting
/usr/lib/squid/pam_auth and restarting it again fixes the problem until a
user logs in and then only that user can log in. /usr/lib/squid/pam_auth
does recognise bad passwords for that user and the OK and ERR responses are
correct. However, all other known good accounts receive an ERR if they were
not the first person to authenticate.

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. Manually run /usr/lib/squid/pam_auth
2. Authenticate as a known good user
3. Using the same account use a bad password
4. Using the same account use the proper password.
5. Attempt to use any other account.
6. Use the known good account.
	

Actual Results:  Only the first user could authenticate successfully.

Expected Results:  All valid username password pairs should be
authenticated and receive an OK response.

Additional info:

This was working fine in RH 7.1. It was only after my upgrade to RH 7.2
that the problem appears. I have even fdisked and rebuilt my PC and the
problem occurs direct from the ISO images. It is not a patch from RH
Network causing the problem.
Comment 1 Andrew Meredith 2002-01-25 07:27:39 EST 
I have just completed a commercial install and had much the same experience. I
did however get slightly different results. The first user did not always
validate even with known good passwords. Subsequent validations may or may not
produce accurate results. I failed to find any good pattern. This was tested
with the connector having been launched by hand outside of squid, so this is not
a core squid issue. To confirm this I ran up a shell script that always gave an
OK response and logged the username/password pairs. Squid behaved just fine.

Also it should be noted that I could not get the connector to work without
making it setuid root. Squid in the default install runs as a non root user and
the PAM connector seems to require root permissions to run properly.
Comment 2 Andrew Meredith 2002-05-18 14:39:08 EDT 
There is an additional/related issue with both the PAM and NCSA authenticators,
neither come as setuid root. As squid runs as a non-root account it does not
have permissions to access the password database .. well not if the system is
running shadow passwords anyway. I am using squid with the ncsa authenticator,
and need to reset the perms on the authentication binary every time the package
is upgraded.

Can these files be routinely setuid root out of the box ?
Comment 3 Andrew Meredith 2003-04-17 07:08:29 EDT 
All of the above is still true for RH 8.0
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.