I have been tasked with modifying the pam.d common-auth login scheme for an ubuntu system and have been given two requirements:
-
if the user hits ‘enter’ after being presented with a prompt, the auth flow will skip to pam_radius_auth.so after which point the user will be prompted for a password again to login using this second password through pam_radius_auth.so
-
the pam_krb5.so login modules must be skipped for system users ( minimum_uid=1600 )
The test system is an instance of Ubuntu 22.04 running on a VM that I am accessing through SSH. After shamefully locking myself out several times ( always keep a second tab open on root and /etc/pam.d/common-auth.bak handy ) I have come up with the following auth scheme
auth [success=6 default=ignore] pam_unix.so debug nullok
auth [success=5 default=ignore] pam_krb5.so debug=true realm=domain1 minimum_uid=1600
auth [success=4 default=ignore] pam_krb5.so debug=true realm=domain2 minimum_uid=1600
auth [success=3 default=ignore] pam_krb5.so debug=true realm=domain3 minimum_uid=1600
auth [success=2 default=ignore] pam_krb5.so debug=true realm=domain4 minimum_uid=1600
#auth optional pam_exec.so debug type=auth /bin/logger PAM:before-radius
auth sufficient pam_radius_auth.so debug
auth requisite pam_deny.so debug
auth required pam_permit.so debug
I have tested this with every flag I can think of to try to get pam.d to go from the use case of to no avail.
Specifically I’ve tried:
-default=reset on each of the […] flags,
-using ‘skip_passwd’ flag on the pam_radius_auth.so module
-every permutation of ‘nullok’ flag
-setting the KbdInteractiveAuthentication flag in /etc/ssh/sshd_config
-written a pam_exec.so python script that reads user input and using the exit code jump in pam.d correspondingly. I stopped after I learned you only get success/failure on ubuntu (maybe not on FreeBSD )) and managing stdin/stdout is a nightmare
At one point in my internet searching I read that pam.d is designed to check one single password against all modules. Is what I am asking feasible without writing or customizing my own auth.so; just using pam.d builtins to skip and trigger a second pw prompt (i.e. make pam_radius_auth use a different pw than pam_unix) or is this a fools errand ?
