Verified Answers

If an answer to your question is correct, click on "Verify Answer" under the "More" button. The answer will now appear with a checkmark. Please be sure to always mark answers that resolve your issue as verified. Your fellow Community members will appreciate it! Learn more

  • State Not Answered
  • Replies replies
    6
  • Subscribers subscribers
    23
  • Views views
    531
  • Users 0 members are here
  • Locked Locked
Related
Options
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

NWlogin with pam_script (TID 3416680)

MigrationDeletedUser
Following the old TID 3416680 for SLED10 I'm trying to set up nwlogin
with pam_script: use PAM_AUTHTOK within /etc/security/onauth to assign
the password of the user doing a (ssh) login to the variable NWpassword
and then using nwlogin with the option --passenv.
Then in /etc/security/onsessionopen the eDirectory login scripts are
called with nwrunscripts.
The problem I have to make this work is that pam_script runs in the
context of root. That is after doing a ssh login as an eDirectory user
effectively root is logged in to the tree and all mapped drives are
owned by root rather than by the user. I did some tests with "su -"
within the scripts but this easily creates a loop as su itself calls
pam_script. So I wonder how to make this work.

Günther
Parents
  • 0
    Günther Schwarz wrote:
    > Following the old TID 3416680 for SLED10 I'm trying to set up nwlogin
    > with pam_script: use PAM_AUTHTOK within /etc/security/onauth to assign
    > the password of the user doing a (ssh) login to the variable NWpassword
    > and then using nwlogin with the option --passenv.
    > Then in /etc/security/onsessionopen the eDirectory login scripts are
    > called with nwrunscripts.
    > The problem I have to make this work is that pam_script runs in the
    > context of root. That is after doing a ssh login as an eDirectory user
    > effectively root is logged in to the tree and all mapped drives are
    > owned by root rather than by the user. I did some tests with "su -"
    > within the scripts but this easily creates a loop as su itself calls
    > pam_script. So I wonder how to make this work.

    OK, I gave up and went back to libpam-script-0.1.12 instead of
    pam-script-1.1.6. The older version runs within the user's context by
    default and thus does indeed work as described in in TID 3416680.
    Unfortunately an option "runas" which is readily available in version
    0.1.12 is missing in 1.1.6.
    If anybody wants to verify this: use "expose=authtok" within the auth
    part of pam in version 0.1.12 instead of "expose=1" for version 0.1.10
    which is used in the TID. Otherwise they seem to behave much the same.

    Günther

Reply
  • 0
    Günther Schwarz wrote:
    > Following the old TID 3416680 for SLED10 I'm trying to set up nwlogin
    > with pam_script: use PAM_AUTHTOK within /etc/security/onauth to assign
    > the password of the user doing a (ssh) login to the variable NWpassword
    > and then using nwlogin with the option --passenv.
    > Then in /etc/security/onsessionopen the eDirectory login scripts are
    > called with nwrunscripts.
    > The problem I have to make this work is that pam_script runs in the
    > context of root. That is after doing a ssh login as an eDirectory user
    > effectively root is logged in to the tree and all mapped drives are
    > owned by root rather than by the user. I did some tests with "su -"
    > within the scripts but this easily creates a loop as su itself calls
    > pam_script. So I wonder how to make this work.

    OK, I gave up and went back to libpam-script-0.1.12 instead of
    pam-script-1.1.6. The older version runs within the user's context by
    default and thus does indeed work as described in in TID 3416680.
    Unfortunately an option "runas" which is readily available in version
    0.1.12 is missing in 1.1.6.
    If anybody wants to verify this: use "expose=authtok" within the auth
    part of pam in version 0.1.12 instead of "expose=1" for version 0.1.10
    which is used in the TID. Otherwise they seem to behave much the same.

    Günther

Children

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Cookies Preferences
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.