su as normal users = Authentication failure

houler · 05-11-2005, 03:05 PM

Quote:

Originally posted by Tinkster
No idea ... Volker doesn't use PAM at all (too nasty
a history of exploits and security holes) ... it has been
introduced to your box by dropline.

See whether other dropline users with slack-current
have advice for you... mine would be to get rid of
Gnome and use slacks default packages.

Cheers,
Tink

Will do later.

It's kinda funny because the dropline-gnome update feature (the one on the desktop) accepts the 'root password'. But when I use any other utility like 'network configuration' or even 'su' it give me a message saying that it's the incorrect password.

zborgerd · 05-12-2005, 09:20 AM

Quote:

Originally posted by houler
It's kinda funny because it was working. Then all of a sudden it just stopped (couldn't escalate priveleges). Maybe I did something and forgot what I did? heh ah well, I might just do a clean install later to fix this issue.

Memo to myself "Document everything significant that you do on your personal system, which includes editing System startup files, config files, etc."

Very bizarre. This should not be happening. I think slapt-get is a great tool, but "upgrades" on Slackware can be a bit unpredictable sometimes. That's why we ask that Dropline users stick to fresh 10.1 installs. 99% of our bug reports come from slapt-get users and are typically those who have updated to Slackware-Current (w.g. the unstable version of Slackware). We only test Dropline on Slackware 10.1 - e.g., the current stable release, and we don't test "upgrades" because they are not the same as fresh installs (there is always some leftover crud from old packages).

You may have some luck by reinstalling:

coreutils-5.2.1-i486-1
cracklib-2.8.2-i686-1dl
shadow-4.0.3-i686-9dl
pam-0.79-i686-2dl

preferably in that order. You can use "upgradepkg --reinstall" on each package.

Be very careful. These are low-level libraries and you can completely break your machine if you don't use caution.

zborgerd · 05-12-2005, 09:26 AM

Quote:

Originally posted by houler
Will do later.

It's kinda funny because the dropline-gnome update feature (the one on the desktop) accepts the 'root password'. But when I use any other utility like 'network configuration' or even 'su' it give me a message saying that it's the incorrect password.

Some things, like the dropline-installer, prompt for a root password by means of consolehelper (which utilizes PAM).

If it's just "su", it could be mucked up settings in /etc/pam.d. Check that a valid pam configuration exists for "su".

Code:

zborgerd@escudo:~$ cat /etc/pam.d/su
#%PAM-1.0

auth       sufficient   /lib/security/pam_rootok.so

# If you want to restrict users begin allowed to su even more,
# create /etc/security/suauth.allow (or to that matter) that is only
# writable by root, and add users that are allowed to su to that
# file, one per line.
#auth       required     /lib/security/pam_listfile.so item=ruser sense=allow onerr=fail file=/etc/security/suauth.allow

# Uncomment this to allow users in the wheel group to su without
# entering a passwd.
#auth       sufficient   /lib/security/pam_wheel.so use_uid trust

# Alternatively to above, you can implement a list of users that do
# not need to supply a passwd with a list.
#auth       sufficient   /lib/security/pam_listfile.so item=ruser sense=allow onerr=fail file=/etc/security/suauth.nopass

# Comment this to allow any user, even those not in the 'wheel'
# group to su
#auth       required     /lib/security/pam_wheel.so use_uid

auth       required     /lib/security/pam_stack.so service=system-auth

account    required     /lib/security/pam_stack.so service=system-auth

password   required     /lib/security/pam_stack.so service=system-auth

session    required     /lib/security/pam_stack.so service=system-auth
session    optional     /lib/security/pam_xauth.so

zborgerd · 05-12-2005, 09:32 AM

Quote:

Originally posted by Tinkster
No idea ... Volker doesn't use PAM at all (too nasty
a history of exploits and security holes) ... it has been
introduced to your box by dropline.

See whether other dropline users with slack-current
have advice for you... mine would be to get rid of
Gnome and use slacks default packages.

Cheers,
Tink

Not to get off-topic, but this is bogus. PAM's history of "exploits" are from third-party modules, and these "exploits" are several years old. This is honestly a better track record than several other things Volkerding includes; Sendmail, Firefox, etc.

http://dlgwiki.dot42.org/index.php/F...ed%20Questions

houler · 05-12-2005, 02:49 PM

Quote:

Originally posted by zborgerd
Very bizarre. This should not be happening. I think slapt-get is a great tool, but "upgrades" on Slackware can be a bit unpredictable sometimes. That's why we ask that Dropline users stick to fresh 10.1 installs. 99% of our bug reports come from slapt-get users and are typically those who have updated to Slackware-Current (w.g. the unstable version of Slackware). We only test Dropline on Slackware 10.1 - e.g., the current stable release, and we don't test "upgrades" because they are not the same as fresh installs (there is always some leftover crud from old packages).

You may have some luck by reinstalling:

coreutils-5.2.1-i486-1
cracklib-2.8.2-i686-1dl
shadow-4.0.3-i686-9dl
pam-0.79-i686-2dl

preferably in that order. You can use "upgradepkg --reinstall" on each package.

Be very careful. These are low-level libraries and you can completely break your machine if you don't use caution.

Holy smokes! it works after I followed your idea. Thank you very much sir.

I can finally su from normal accounts and also use administration utilities and I didn't have to reinstall slack 10.1.

Thanks again, zborgerd.

zborgerd · 05-12-2005, 05:11 PM

Quote:

Originally posted by houler
Holy smokes! it works after I followed your idea. Thank you very much sir.

I can finally su from normal accounts and also use administration utilities and I didn't have to reinstall slack 10.1.

Thanks again, zborgerd.

Certainly. I'm glad it's working for you. I'm not sure why things got messed up (this is the first time I've seen this, and I've been using Dropline since 2002), but feel free to stop by the forums at dropline.net if you need anything else. Due to the nature of its configurability, any number of things can change something on Slackware. There is almost always a fix though, and there are a lot of great people in the Dropline forums that can usually solve just about anything.

dhave · 06-08-2005, 04:40 PM

Quote:

Originally posted by zborgerd

You may have some luck by reinstalling:

coreutils-5.2.1-i486-1
cracklib-2.8.2-i686-1dl
shadow-4.0.3-i686-9dl
pam-0.79-i686-2dl

preferably in that order. You can use "upgradepkg --reinstall" on each package.

Be very careful. These are low-level libraries and you can completely break your machine if you don't use caution.

Thanks a lot for this advice. I had the "su: Unknown module" problem after I installed a stock Linux Pam when I was building Enlightenment. It goofed up the vestiges of Dropline -- including Pam -- that remained on my system from a time experimenting with Dropline a few months ago.

I found the four packages you mentioned and reinstalled them and now "su" works again.