Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-19881

pam plugin from MariaDB 10.3 doesn't work with MariaDB 10.4

    XMLWordPrintable

Details

    Description

      As a way to work around the numerous pam bugs in MariaDB 10.4.6, I tried to copy the pam plugins from MariaDB 10.3.16. This does not work, and it fails instantly without even asking for a password.

      For example, copy the plugin from the 10,3 to the 10.4 server:

      scp  /usr/lib64/mysql/plugin/auth_pam.so 172.30.0.123:/tmp/

      Then move the existing one on the 10.4 server:

      sudo mv /usr/lib64/mysql/plugin/auth_pam.so /usr/lib64/mysql/plugin/auth_pam.so.original

      And then install the one from 10.3:

      sudo install /tmp/auth_pam.so /usr/lib64/mysql/plugin/

      Create a Unix user account and set a password for the user:

      sudo useradd alice
      		 
      sudo passwd alice

      Create the PAM service configuration:

      sudo tee /etc/pam.d/mariadb <<EOF
      		 
      auth required pam_unix.so audit
      		 
      account required pam_unix.so audit
      		 
      EOF

      Then in MariaDB, install the plugin:

      INSTALL SONAME 'auth_pam';

      And then create the user account:

      CREATE USER 'alice'@'localhost' IDENTIFIED VIA pam USING 'mariadb';

      And then you need to do the /etc/shadow workaround for pam_unix:

      sudo groupadd shadow
      		 
      sudo usermod -a -G shadow mysql
      		 
      sudo chown root:shadow /etc/shadow
      		 
      sudo chmod g+r /etc/shadow

      And then restart MariaDB:

      sudo systemctl restart mariadb

      And then, try to authenticate as the Unix account (while using the workaround for MDEV-19807):

      $ mysql -u alice --plugin-dir=/usr/lib64/mysql/plugin
      		 
      ERROR 1045 (28000): Access denied for user 'alice'@'localhost' (using password: NO)

      Unlike in MDEV-19880, the syslog doesn't even show a failed password check.

      Attachments

        Issue Links

          is caused by

          Task - A task that needs to be done. MDEV-7032 new pam plugin with a suid wrapper

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Task - A task that needs to be done. MDEV-15473 Isolate/sandbox PAM modules, so that they can't crash the server

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-19876 pam v2: auth_pam_tool_dir and auth_pam_tool permissions are wrong in RPMs

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Task - A task that needs to be done. MDEV-19877 pam v2: auth_pam_tool input format is not user friendly for debugging

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Open

          Bug - A problem which impairs or prevents the functions of the product. MDEV-19878 pam v2: pam password authentication doesn't work at all

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-19879 server can send empty error message to client with pam_use_cleartext_plugin

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-19880 pam v1: pam password authentication doesn't work at all in MariaDB 10.4

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-19882 pam v2: auth_pam_tool truncates passwords that are not null-terminated

          • Major - Major loss of function.
          • Closed

          Task - A task that needs to be done. MDEV-19898 PAM plugin testing

          • Major - Major loss of function.
          • Stalled

          Activity

            People

              serg Sergei Golubchik
              GeoffMontee Geoff Montee (Inactive)
              Votes:
              2 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.