1

I've been trying to use cached credentials to be able to log into an offline laptop but haven't been able to get it to work.

I've installed pam_ccreds and it seems to be caching the passwords without problem. Running sudo cc_dump displays a table showing salted hashes and usernames containing both the local and LDAP users which have logged in but the LDAP users in the database can't log in when the laptop is disconnected from the network.

If I try to su to an LDAP user will disconnected, after entering the password it seems to succeed for about a second before failing

You have been logged on using cached credentials. 
su: Authentication failure

In a tty session, a message which I think is the same as the first line above flashes on the screen for a fraction of a second before returning to the login prompt. Attempting to log in from the greeter and it just fails after entering the password. I suspect the same is happening but the message isn't visible. It appears to fail immediately in the same way an incorrect password does.

The common-auth file is

# here are the primary per-package modules (the "Primary" block)
auth    [success=4 default=ignore]  pam_unix.so nullok
auth    [success=3 default=ignore]  pam_ldap.so use_first_pass
auth    [success=2 default=ignore]  pam_ccreds.so minimum_uid=1000 action=validate use_first_path
auth    [default=ignore]            pam_ccreds.so minimum_uid=1000 action=update
# here's the fallback if no module succeeds
auth    requisite                   pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                    pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional                    pam_ccreds.so minimum_uid=1000 action=store
auth    optional                    pam_cap.so
# end of pam-auth-update config

Is there a problem with the common-auth file or is this being caused by something else?

The common-account files is

# here are the primary per-package modules (the "Primary" block)
auth    [success=2 new_authtok_reqd=done default=ignore]  pam_unix.so
auth    [success=1 default=ignore]  pam_ldap.so
# here's the fallback if no module succeeds
auth    requisite                   pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                    pam_permit.so
# and here are more per-package modules (the "Additional" block)
# end of pam-auth-update config
5
  • Can you edit the question to include the common-account file as well? There is a specific sequence of commands required to allow authentication when the LDAP server is unavailable 🤐
    – matigo
    Oct 16 at 9:50
  • I hadn't come across any setting for common-account in the documentation I used so I expect that is likely to be the problem. I've added it to the post. Oct 16 at 12:03
  • Ah, silly me. The common-account file was deprecated years ago. Was just reading through my notes. That said, I spotted a typo in your common-auth file ⇢ success=3 default=ingore. You might want to fix “ignore” 😬
    – matigo
    Oct 16 at 12:13
  • Thanks. I am not sure how that happened, but it seems it was after I pasted the content because it is correct in the file itself. The typo was only in my post. I've corrected it now. Oct 16 at 12:34
  • @matigo although you said common-account has been deprecated, I decided to see if it was the cause of the problem. Changing the last line in the primary block to auth [success=1 default=ignore authinfo_unavail=1] pam_ldap.so allows me to log on while offline. However, that change on its own doesn't feel like a good idea as it avoids pam_deny.so altogether when offline. Maybe the other module types fill any security gaps but I don't know PAM well enough to be sure. Oct 17 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.