I've setup Kerberos authentication on a Linux box to authenticate users against an Active Directory domain. It is working, however, for each domain user that authenticates I get the following in /var/log/secure:
Jun 10 08:58:27 dev sshd[8532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=123.456.789.123 user=bjones
Jun 10 08:58:27 dev sshd[8532]: pam_krb5[8532]: authentication succeeds for 'bjones' (bjones@CORP.DOMAIN.LAN)
Jun 10 08:58:27 dev sshd[8532]: Accepted password for bjones from 123.456.789.123 port 2716 ssh2
Jun 10 08:58:27 dev sshd[8532]: pam_unix(sshd:session): session opened for user bjones by (uid=0)
The problem I have with this is the 'authentication failure' log for all of the domain users (because it is failing to authenticate locally). So I edited /etc/pam.d/system-auth and changed:
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_krb5.so use_first_pass
auth required pam_deny.so
to:
auth required pam_env.so
auth sufficient pam_krb5.so use_first_pass
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
Which works, however, now I present myself with another problem that I need to restrict domain authentication to user IDs 500 and above. With the above change, users such as 'root' in the domain will authenticate with credentials from active directory. So I switched it back to the original (moved "auth sufficient pam_krb5.so use_first_pass" back down). I also changed the "... >= 500 quiet" to "... >= 700 quiet" so that I could still create ~200 local users that would not authenticate via the domain (i.e. 3rd party software accounts... like 'oracle').
So my question is... can I control which users authenticate via Kerberos/domain (i.e. users with an ID of 700 or above) AND can I specify which pam module to use (i.e. domain accounts should skip pam_unix and use pam_krb5) so that I do not get a 'authentication failure' log for the filed pam modules?
Start Free Trial
