lintweaker wrote:
lintweaker wrote:
I just got my keys and am trying to get offline pam working.
Whenever I try to login with the correct key I get:
Code:
Mar 13 13:11:48 paragon yk_chkpwd[13893]: password check failed for user (kramer)
Mar 13 13:11:48 paragon unix_chkpwd[13895]: password check failed for user (kramer)
Mar 13 13:11:48 paragon login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost= user=kramer
Mar 13 13:11:50 paragon login: FAILED LOGIN 1 FROM (null) FOR kramer, Authentication failure
ykvalidate works as it should (although only under root):
ykvalidate --user kramer [optremoved]
OTP is VALID.
This is with Fedora 10 x86_64. Any hints on how to investigate this further?
I've rebuild the libaries with debugging enabled. The log files show:
Code:
[pam_yubikey.c:get_response(206)] conv returned: [snipped]
[pam_yubikey.c:_yubi_run_helper_binary(259)] called.
[yk_chkpwd.c:_yubi_verify_password(255)] Recived OTP: [snipped]
[yk_chkpwd.c:_yubi_verify_password(263)] Parsing OTP
[yk_chkpwd.c:_yubi_verify_password(279)] couldn't access database: /etc/yubikey
[pam_yubikey.c:_yubi_run_helper_binary(375)] returning 9
So somehow /etc/yubikey cannot be read. As this is on a Fedora machine with selinux enabled I had to change to /etc/yubikey context as well. I 'stole' the context from another file in /etc:
Code:
chcon -v --reference=/etc/wvdial.conf yubikey
I am not sure that's correct but I no longer get selinux messages. Unfortunately the problem persists, even after giving everybody read rights on the /etc/yubikey file. Clueless
OK, again replying to my on message.
Default the file /etc/yubikey has the following permission:
-rw-r--r-- root root
Checking the ykdbDatabaseOpen function in yubikey_db.c shows:
Code:
/* open the db */
handle->file_descriptor = open(path, O_RDWR);
if (handle->file_descriptor == -1)
{
free(handle);
YKDB_ERROR(YKDB_ERR_IO);
return NULL;
that the database will be opened with Read Write permissions (is that really necessary here?).
Changing the permissions on /etc/yubikey gets rid of the 'could not access database error':
Code:
[ykvalidate.c:_yubi_run_helper_binary(275)] called.
[yk_chkpwd.c:_yubi_verify_password(255)] Recived OTP: [snipped]
[yk_chkpwd.c:_yubi_verify_password(263)] Parsing OTP
[ykvalidate.c:_yubi_run_helper_binary(388)] returning 0
I am not sure this is the right way forward.
Login
FAQ
Search
