答复: Pam-list Digest, Vol 46, Issue 16

I see ,thanks!

发件人: pam-list-bounces redhat com [mailto:pam-list-bounces redhat com] 代表 Andreas Schindler
发送时间: 2007年12月30日 21:54
收件人: pam-list redhat com
主题: Re: Pam-list Digest, Vol 46, Issue 16

pam-list-request redhat com schrieb:

Send Pam-list mailing list submissions to

        pam-list redhat com

To subscribe or unsubscribe via the World Wide Web, visit

        https://www.redhat.com/mailman/listinfo/pam-list

or, via email, send a message with subject or body 'help' to

        pam-list-request redhat com

You can reach the person managing the list at

        pam-list-owner redhat com

When replying, please edit your Subject line so it is more specific

than "Re: Contents of Pam-list digest..."

Today's Topics:

   1. the item ruser of pam_listfile.so  cann`t work (liuruihong)

Betreff:

the item ruser of pam_listfile.so cann`t work

Von:

"liuruihong" <liuruihong baidu com>

Datum:

Sat, 29 Dec 2007 12:04:19 +0800

An:

<pam-list redhat com>

An:

<pam-list redhat com>

My /etc/pam.d/sshd on sz-ssl-test00.sz01:

#%PAM-1.0

auth required pam_listfile.so item=ruser sense=allow file=/etc/test

auth required pam_stack.so service=system-auth

auth required pam_nologin.so

account required pam_stack.so service=system-auth

password required pam_stack.so service=system-auth

session required pam_stack.so service=system-auth

session required pam_loginuid.so

there are only one user in /etc/test:

lrh

when I login from remote using commands as fllows:

[lrh test15 home]$ ssh liuruihong sz-ssl-test00 sz01

liuruihong sz-ssl-test00 sz01's password:

Permission denied, please try again.

liuruihong sz-ssl-test00 sz01's password:

[lrh test15 home]$

I cann`t login ,why?

_______________________________________________

Pam-list mailing list

Pam-list redhat com

https://www.redhat.com/mailman/listinfo/pam-list

Liuruihong,

please note: 'ruser' should be set to the user's name on the remote host, that
issues the authentication sequence, in your case obviously 'lrh' at host 'test15'.
But this parameter is optional, in many cases it is left unset.

IMHO what you should test via pam_listfile is 'user', not 'ruser'.
The 'user' token is the name you whish to authenticate against,
in other words: 'user' is the parameter which requires a matching password.

Additionally, please note that after all 'user' may not be the same as the name
of the account you're finally logged in to, which is e.g. in U*X the passwd identity.

Regards

--
Dr.-Ing. Andreas Schindler

PDV Systeme AZ1 GmbH
Frankfurter Str. 141
63303 Dreieich

Telefon 06103-57187-21
Telefax 06103-373245

schindler az1 de
www.az1.de

PDV Systeme AZ1 GmbH, Brandeniusstr. 3, 44265 Dortmund
HRB 11089 Amtsgericht Dortmund, Geschäftsführer : Klaus-Jürgen Koke, Joachim Carle