Re: [gentoo-user] pam fixed now it's tcpdump

[Alan McKinnon]

On Wednesday 30 January 2008, maxim wexler wrote:
> --- Alan McKinnon <alan.mckinnon@×××××.com> wrote:
> > Well, the docs page on the upgrade to pam-0.99 is
> > complete, I updated
> > severala machines no problem with it. So you must
> > have muffed the
> > instructions. Next time, read the whole page.
>
> While I was waiting I went back to the page and
> decided I should probably emerge pam_chroot.
> pam_userdb didn't seem to involve me so I left it
> alone. Other than that I couldn't see what else
> applied to my case except for the suggestion that
> some, unamed, file should be edited. I notice that
> since I apparently overleapt the main pam hurdle
> /etc/pam.d has a new system-auth file in it. Must be
> on the right track cause it didn't complain about
> pam-0.99 when pam_chroot was emerged.

FWIW, I have a stock standard workstation system pam-wise. I hanged no 
files from the default, it all works and upgrades were seamless. Here's 
the pam modules I have:

nazgul / # eix ^pam | grep sys-auth
* sys-auth/pam-afs-session
* sys-auth/pam_abl
* sys-auth/pam_bioapi
* sys-auth/pam_chroot
* sys-auth/pam_dotfile
* sys-auth/pam_keyring
* sys-auth/pam_krb5
* sys-auth/pam_ldap
* sys-auth/pam_mktemp
* sys-auth/pam_mount
* sys-auth/pam_mysql
* sys-auth/pam_p11
* sys-auth/pam_passwdqc
* sys-auth/pam_pkcs11
* sys-auth/pam_pwdfile
* sys-auth/pam_require
* sys-auth/pam_sha512
* sys-auth/pam_skey
* sys-auth/pam_smb
* sys-auth/pam_ssh
* sys-auth/pam_ssh_agent
* sys-auth/pam_usb
* sys-auth/pam_userdb
* sys-auth/pam_blue [1]
* sys-auth/pam_pgsql [1]
* sys-auth/pam_sotp [1]

and my /etc/pam.d/

nazgul / # ls -al /etc/pam.d
total 146
drwxr-xr-x  2 root root 1072 2008-01-18 21:49 .
drwxr-xr-x 92 root root 5464 2008-01-29 23:56 ..
-rw-r--r--  1 root root  152 2007-11-09 19:03 chage
-rw-r--r--  1 root root  152 2007-11-09 19:03 chfn
-rw-r--r--  1 root root  103 2007-11-09 19:03 chgpasswd
-rw-r--r--  1 root root  152 2007-11-09 19:03 chpasswd
-rw-r--r--  1 root root  152 2007-11-09 19:03 chsh
-rw-r--r--  1 root root  123 2007-11-02 12:59 cron
-rw-r--r--  1 root root  113 2008-01-18 21:42 cups
-rw-r--r--  1 root root  106 2007-11-05 15:21 cvs
-rw-r--r--  1 root root  223 2008-01-07 23:05 entrance
-rw-r--r--  1 root root  152 2007-11-09 19:03 groupadd
-rw-r--r--  1 root root  152 2007-11-09 19:03 groupdel
-rw-r--r--  1 root root  103 2007-11-09 19:03 groupmems
-rw-r--r--  1 root root  152 2007-11-09 19:03 groupmod
-rw-r--r--  1 root root  362 2007-11-02 12:57 imap
lrwxrwxrwx  1 root root   15 2007-11-02 12:57 imap4 -> /etc/pam.d/imap
lrwxrwxrwx  1 root root   15 2007-11-02 12:57 imap4s -> /etc/pam.d/imap
lrwxrwxrwx  1 root root   15 2007-11-02 12:57 imaps -> /etc/pam.d/imap
-rw-r--r--  1 root root  197 2007-11-05 07:17 kde
-rw-r--r--  1 root root  196 2007-11-05 07:17 kde-np
-rw-r--r--  1 root root  563 2007-11-09 19:03 login
-rw-r--r--  1 root root  152 2007-11-09 19:03 newusers
-rw-r--r--  1 root root  139 2007-11-14 11:58 other
-rw-r--r--  1 root root  104 2007-11-09 19:03 passwd
-rw-r--r--  1 root root  362 2007-11-02 12:57 pop
lrwxrwxrwx  1 root root   14 2007-11-02 12:57 pop3 -> /etc/pam.d/pop
lrwxrwxrwx  1 root root   14 2007-11-02 12:57 pop3s -> /etc/pam.d/pop
lrwxrwxrwx  1 root root   14 2007-11-02 12:57 pops -> /etc/pam.d/pop
-rw-r--r--  1 root root  183 2007-11-02 12:58 ppp
-rw-r--r--  1 root root  397 2008-01-18 21:48 samba
-rw-r--r--  1 root root  160 2008-01-18 21:30 saslauthd
-rw-r--r--  1 root root   84 2007-11-05 18:32 screen
-rw-r--r--  1 root root  152 2007-11-09 19:03 shadow
-rw-r--r--  1 root root  205 2008-01-18 21:21 sshd
-rw-r--r--  1 root root 1059 2007-11-09 19:03 su
-rw-r--r--  1 root root  172 2008-01-18 21:25 sudo
-rw-r--r--  1 root root  447 2007-11-14 11:58 system-auth
-rw-r--r--  1 root root  152 2007-11-09 19:03 useradd
-rw-r--r--  1 root root  152 2007-11-09 19:03 userdel
-rw-r--r--  1 root root  152 2007-11-09 19:03 usermod
-rw-r--r--  1 root root  218 2008-01-16 09:24 vmware-guestd
-rw-r--r--  1 root root  125 2008-01-14 21:38 xserver


WorksForMe <shrug>

> Then I made
> detour and updated a bunch of /etc files that had
> popped up after having started the massive update. I
> must have missed modprobe cause when I booted again a
> boot warning flashed by, "warning modprobe.conf not
> generated". Then it got to login where I was again not
> allowed access. Does that have something to do with
> modprobe.conf? PAM? Both?

Not related that I can see. modprobe.conf not being updated is a 
separate issue, solved by running modules-update in an existing root 
shell

> > Meanwhile, boot off a LiveCD or some other medium.
> > or maintenance mode,
> > chroot into gentoo and find all packages that depend
> > on pam:
> >
> > equery depends pam
>
> AttributeError: Package instance has no attribute
> 'get_postmerge_deps'
>
> > or maybe
> > euse -i pam
>
> no matching entries found
>
> As for modprobe, I just chrooted again and ran
> update-modules. I forgot to add -v on the first pass,
> so I did it again with -v and it's telling me
>
> *Skipping /etc/modules.conf generation(prerequisites
> not satisfied
> *Skipping /etc/modprobe.conf generation (file is newer
> than dependencies)
> * The dir '/lib/modules/2.6.15-gentoo-r5/modules.dep'
> does not exist, skipping call to depmod
>
> So this is wierd: according to ls -l
> /etc/modprobe.conf was just written.

The mtime does not mean that the file was not written.

I'd be more worried why you don't have 
a /lib/modules/2.6.15-gentoo-r5/modules.dep.

Look into your /etc/modules.d/ and modprobe.conf and see what's there.

> Or is it because the PC is in a chrooted environment
> and uses a different set of modules?

No, chroot uses the running kernel. It's not a virtualised environment.

Maxim, I've been watching your posts for a while now, and most times 
it's because you made some blunder that is quite elementary and that 
you really should know. Your problem seems to be a lack of 
understanding of how Unix works.

You really really need to start reading documentation. Your gentoo life 
will go much easier when you do.


-- 
Alan McKinnon
alan dot mckinnon at gmail dot com
-- 
gentoo-user@l.g.o mailing list