PostgreSQL user authentication against PAM
- by elmuerte
I am trying to set up authentication via PAM for PostgreSQL 9.3. I already managed to get this working on an Ubuntu 12.04 server, but I am unable to get this working on a Centos-6 install.
The relevant pg_hba.conf line:
host all all 0.0.0.0/0 pam pamservice=postgresql93
The pam.d/postgressql93 is the default config shipped with the official postgresql 9.3 package:
#%PAM-1.0
auth include password-auth
account include password-auth
When a user tries to authenticate the following is reported in secure log:
hostname unix_chkpwd[31807]: check pass; user unknown
hostname unix_chkpwd[31808]: check pass; user unknown
hostname unix_chkpwd[31808]: password check failed for user (myuser)
hostname postgres 10.1.0.1(61459) authentication: pam_unix(postgresql93:auth):
authentication failure; logname= uid=26 euid=26 tty= ruser= rhost= user=myuser
The relevant content of password-auth config is:
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth required pam_deny.so
account required pam_unix.so
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account required pam_permit.so
The problem is with the pam_unix.so. It is unable to validate the password, and unable to retrieve the user info (when I remove the auth entry of pam_unix.so).
The Centos-6 install is only 5 days old, so it does not have a lot of baggage.
The unix_chkpwd is suid and has execute rights for everybody, so it should be able to check the shadow file (which has no privileges at all?).
