[SOLVED] Unable to authenticate with pam on 16.04

I upgraded to 16.04 from 2.x, and now I can't authenticate using pam.

I switched to internal authentication as a test, and it all works fine.

I think I traced the problem to the epam helper program.

Here is my xmpp pam service file: (I added pam_warn.so to get log messages)

# File autogenerated by pamd_mimic in pam eclass

auth    required        pam_warn.so
auth    include         system-auth
account include         system-auth 

I used the pamtester program (from here: http://pamtester.sourceforge.net/) to test that, and it works fine.

pamtester -I ruser=me xmpp me authenticate
Password:
pamtester: successfully authenticated 

When I do that, this shows up in syslog:

Aug 26 10:36:29 hostname pamtester: pam_warn(xmpp:auth): function=[pam_sm_authenticate] flags=0 service=[xmpp] terminal=[] user=[me] ruser=[me] rhost=[]

But when I try to log in using Pidgin, this is what shows up in syslog:

Aug 26 10:39:20 hostname epam: pam_warn(xmpp:auth): function=[pam_sm_authenticate] flags=0 service=[xmpp] terminal=[] user=[me] ruser=[me] rhost=[]
Aug 26 10:39:20 hostname unix_chkpwd[11274]: check pass; user unknown
Aug 26 10:39:20 hostname unix_chkpwd[11275]: check pass; user unknown
Aug 26 10:39:20 hostname unix_chkpwd[11275]: password check failed for user (me)
Aug 26 10:39:20 hostname epam: pam_unix(xmpp:auth): authentication failure; logname= uid=103 euid=103 tty= ruser=me rhost=  user=me 

Notice that the first line contains the same information as the entry from pamtester, in particular the same user name.

It looks like epam isn't passing the user name correctly.

Is there any way I can see what it's doing? Or does anyone have any ideas?

The issue was that epam

The issue was that epam wasn't running as root.

I'd seen that this needed to be done in the documentation, but did not realize that ejabberd starts epam and leaves it running. So when I toggled it initially, it didn't seem to have any effect.

I had to shut down the server, then do the chmod, then restart to get it all to work.

I ran into this same issue

I ran into this same issue when upgrading from Fedora 22 to Fedora 24.

Fedora now packages epam in the erlang-p1_pam package, which I have installed - but I can find no instructions on how to configure ejabberd to start epam.

I found this Fedora issue

I found this Fedora issue related to ejabberd and epam:
https://bugzilla.redhat.com/show_bug.cgi?id=1337216

And I posted a workaround there - make epam setuid root as the ejabberd instructions enumerate:
chmod 4750 /usr/lib/erlang/lib/p1_pam-1.0.0/priv/bin/epam

Aha thanks! I've been banging

Aha thanks!
I've been banging my head on this since I upgraded last night.
I found out that on my Gentoo install there are 2 copies of epam and apparently ejabberd uses both for different things. I had already fixed the one in the ejabberd directory (which resolved several errors), but not the other one you mentioned (which fixed actual auth).

Quote: I found out that on my

Quote:

I found out that on my Gentoo install there are 2 copies of epam

This sounds like a Gentoo packaging issue.

Syndicate content