[MDEV-9150] pam_user_map causes pam unknown user error or segfault Created: 2015-11-18 Updated: 2020-10-20 |
|
| Status: | Open |
| Project: | MariaDB Server |
| Component/s: | Authentication and Privilege System |
| Affects Version/s: | 10.0.22 |
| Fix Version/s: | None |
| Type: | Bug | Priority: | Major |
| Reporter: | Mikael Knutsson | Assignee: | Elena Stepanova |
| Resolution: | Unresolved | Votes: | 0 |
| Labels: | None | ||
| Environment: |
OS: Debian GNU/Linux 8.1 (jessie) |
||
| Description |
|
I've confirmed that without pam_user_map auth_pam works just fine, (ie the user with the same name exists in passwd and in the database.) We're trying to use pam_user_map with this conf: /etc/pam.d/mysql:
/etc/security/user_map.conf
The user dbadmin exists in the database with [...] AUTHENTICATED VIA pam set. Two scenarios can happen. First scenario is if the user dbadmin does not exist in /etc/passwd.
The second scenario is if dbadmin actually exists for pam_unix (/etc/passwd), then I get this:
I did some changes to squash a few implicit warnings I was getting from the compiler as well as the #define PAM_SM_AUTH to make sure PAM allowed it to act as an authentication module.
Some other notes: |
| Comments |
| Comment by Elena Stepanova [ 2015-11-19 ] |
|
I think I might be missing something in your setup. |
| Comment by Mikael Knutsson [ 2015-11-20 ] |
|
I've set up an anonymous user with identified via pam The idea with the pam_user_map plugin that is a part of your source tree is that you do the remap of the user before it goes back to the database from PAM, so proxy should not be needed. I also tried with a PROXY grant, but that did not change anything, I'm afraid. |
| Comment by Geoff Montee (Inactive) [ 2020-10-20 ] |
|
Hi mikn,
This is incorrect. It is true that the pam_user_map PAM module remaps the user, and then provides the new remapped user name to the database. However, there are two other details that you need to keep in mind:
This is described here: https://mariadb.com/kb/en/user-and-group-mapping-with-pam/#creating-users And another related detail to keep in mind:
This is described here: https://mariadb.com/kb/en/user-and-group-mapping-with-pam/#pam-user-with-same-name-as-mapped-mariadb-user-must-exist
The version of pam_user_map from the MariaDB 10.0.22 source distribution has not been updated in 8 years, so I suspect that it has a lot of old bugs: https://github.com/MariaDB/server/blob/mariadb-10.0.22/plugin/auth_pam/mapper/pam_user_map.c Compare this version to the version in MariaDB 10.5.6: https://github.com/MariaDB/server/blob/mariadb-10.5.6/plugin/auth_pam/mapper/pam_user_map.c I would suggest trying a more recent version of pam_user_map to determine if that fixes the crashes. Also, I should mention that if you upgrade to MariaDB 10.4 or later, then PAM crashes won't crash the whole server. See |