| Summary: | app-admin/sudo-1.6.8_p9 breaks LDAP authentication | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Christopher G. Stach II <cgs> |
| Component: | Current packages | Assignee: | Tavis Ormandy (RETIRED) <taviso> |
| Status: | RESOLVED NEEDINFO | ||
| Severity: | normal | CC: | eva, lcars |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Other | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
|
Description
Christopher G. Stach II
2005-06-27 12:53:39 UTC
Please paste your /etc/pam.d/sudo and /etc/pam.d/system-auth. sudo-1.6.8_p9 works fine here with pam_ldap with shipped /etc/pam.d/sudo. Could you try emerging sudo without the ldap USE flag? I can't test the newer one until mmmaybe later tonight. It's on a production machine. The /etc/pam.d/sudo files are in the sudo FILESDIR. They were not modified after the install. The working one is files/sudo, the failing one files/sudo- 1.6.8_p8. /etc/pam.d/system-auth: #%PAM-1.0 auth required /lib/security/pam_env.so auth sufficient /lib/security/pam_unix.so likeauth nullok auth sufficient /lib/security/pam_ldap.so use_first_pass auth required /lib/security/pam_deny.so account sufficient /lib/security/pam_unix.so #account [default=bad success=ok user_unknown=ignore service_err=ignore system_err=ignore] /lib/security/pam_ldap.so account sufficient /lib/security/pam_ldap.so account required /lib/security/pam_deny.so password required /lib/security/pam_cracklib.so retry=3 password sufficient /lib/security/pam_unix.so nullok use_authtok md5 shadow password sufficient /lib/security/pam_ldap.so use_authtok password required /lib/security/pam_deny.so session required /lib/security/pam_limits.so session required /lib/security/pam_unix.so session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0 session optional /lib/security/pam_ldap.so pam_ldap: ldap_simple_bind Can't contact LDAP server pam_ldap takes its configuration from /etc/ldap.conf, if pam fails every pam_ldap app should fail so this doesn't look like a sudo specific issue. Is passwd working? Are you using ldap for exporting accounts? Can you test other pam_ldap aware applications? Everything else that is in regular use works properly. As far as I can tell, sudo is the only program affected. pam_ldap works, else I wouldn't have reported this bug. It also works with the older sudo. I suppose it's somehow magical... Does new sudo works with old sudo pam.d file? I copied the files/sudo config right after it broke to test if that was the problem. It did not seem to help. I didn't try the sample.pam from the newer tar, however. I will try both again when I get a chance to test. Any further tests about this? Andrea: Think this is a WFM? Reporter: Some more information would be helpful, we cant see what could be going wrong. Closing as NEEDINFO. |
