Hi, >> I am trying to ssh into my fc18 server as root and have the following >> message in syslog: >> >> Mar 18 18:29:20 bwipropnew sshd[12473]: pam_succeed_if(sshd:auth): >> requirement "uid >= 1000" not met by user "root" > > You'll see that after an auth failure for any account with uid < 1000: > Mar 18 23:11:47 vagabond unix_chkpwd[6076]: password check failed for user > (root) > Mar 18 23:11:47 vagabond sshd[6073]: pam_unix(sshd:auth): authentication > failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=localhost user=root > Mar 18 23:11:47 vagabond sshd[6073]: pam_succeed_if(sshd:auth): requirement > "uid >= 1000" not met by user "root" > Mar 18 23:11:50 vagabond sshd[6073]: Failed password for root from ::1 port > 51784 ssh2 > > The standard config looks like this: > > auth required pam_env.so > auth sufficient pam_unix.so nullok try_first_pass > > auth requisite pam_succeed_if.so uid >= 1000 quiet_success > auth required pam_deny.so > > pam_env sets or unsets environment variables and succeeds. > > pam_unix will process the password provided. If the password is correct, > this list will stop processing. If not... > > pam_succeed_if will succeed for user accounts and then pass to pam_deny, > which causes the authentication attempt to fail. > > pam_succeed_if will fail immediately for system accounts, without using > pam_deny. > > If you're using LDAP or KRB5 authentication, it will appear in between those > two lines. That authentication module (pam_sss normally) will be usable by > users with uid >= 1000, but not by system user accounts.
It appears that you're saying ssh as root would fail because of the UID >=1000 and pam_deny, but it works on my system, yet still gives that error (sometimes). Can I ask you to clarify how it relates to remote root access? Somehow remote ssh root access works on my system, so I don't understand which pam module would be denying access? Also, why are the UIDs hardcoded in pam.d files when there is /etc/login.defs? How does that file apply to this? Thanks, Alex -- users mailing list users@lists.fedoraproject.org To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
