Re: Informix & implicit PAM results in "Server....
On Wed, 2016-07-13 at 08:51 -0400, Adam Tauno Williams wrote:
> On Mon, 2016-07-11 at 08:04 -0400, Fernando Nunes wrote:
> > Can you add the PAM file configuration?
> > And regarding the error.... it looks like the sqlstatus. Can you
> > try a remote dbaccess to obtain the native error?
> [root@argus ~]# cat /etc/pam.d/informix
> # PAM Challenge module
> # Module-type Control-flag Module path Options
> auth required pam_krb5.so debug
> keytab=FILE:/etc/krb5.keytab
> And PAM is returning success:
So... authentication succeeds. *BUT* PAM authentication also requires
an "account" entry in the stack. Adding the promiscuous module as the
account entry resolved the issue - clients now authenticate as
expected.
[root@argus tmp]# cat /etc/pam.d/informix
# PAM Challenge module
auth required pam_krb5.so keytab=FILE:/etc/krb5.keytab
account required pam_permit.so
Priceless - http://informix-technology.blogspot.com/2007/11/informix-us
er-authentication-pam-for.html
Apparently a failure for the "account" phase produces no log messages -
anywhere.
Seems like a forehead-slap-obvious kind of thing after-the-fact.
--
Meetings Coordinator, Michigan Association of Railroad Passengers
537 Shirley St NE Grand Rapids, MI 49503-1754 Phone: 616.581.8010
E-mail: awilliam@whitemice.org GPG#D95ED383 Web: http://www.marp.org