Re: Informix & implicit PAM results in "Server....

On Wed, 2016-07-13 at 08:51 -0400, Adam Tauno Williams wrote: > On Mon, 2016-07-11 at 08:04 -0400, Fernando Nunes wrote: > > Can you add the PAM file configuration? > > And regarding the error.... it looks like the sqlstatus. Can you > > try a remote dbaccess to obtain the native error? > [root@argus ~]# cat /etc/pam.d/informix > # PAM Challenge module > # Module-type Control-flag Module path Options > auth required pam_krb5.so debug > keytab=FILE:/etc/krb5.keytab > And PAM is returning success: So... authentication succeeds. *BUT* PAM authentication also requires an "account" entry in the stack. Adding the promiscuous module as the account entry resolved the issue - clients now authenticate as expected. [root@argus tmp]# cat /etc/pam.d/informix # PAM Challenge module auth required pam_krb5.so keytab=FILE:/etc/krb5.keytab account required pam_permit.so Priceless - http://informix-technology.blogspot.com/2007/11/informix-us er-authentication-pam-for.html Apparently a failure for the "account" phase produces no log messages - anywhere. Seems like a forehead-slap-obvious kind of thing after-the-fact. -- Meetings Coordinator, Michigan Association of Railroad Passengers 537 Shirley St NE Grand Rapids, MI 49503-1754 Phone: 616.581.8010 E-mail: awilliam@whitemice.org GPG#D95ED383 Web: http://www.marp.org