1

We have 

auth        optional      pam_krb5.so try_first_pass

in 

/etc/pam.d/password-auth-ac

and 

/etc/pam.d/system-auth-ac

however when I do a klist after successful login, I get 

klist: No credentials cache found (filename: /tmp/nnnnn)

What could be the reason for this?

auth and session stack:

auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        required      pam_tally2.so deny=12 unlock_time=3600
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        optional      pam_krb5.so try_first_pass
auth        sufficient    pam_sss.so forward_pass
auth        required      pam_deny.so



session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so
Saqib Ali
  • 410
  • 2
  • 7
  • 19
  • Please show the entire auth stack. I also recommend showing session. Some krb5 implementations might not call `pam_setcred()` within the auth stack. – Andrew B Jun 29 '17 at 20:36
  • @AndrewB, i added the auth and the session stack. please advise. – Saqib Ali Jun 29 '17 at 21:22
  • 1) Are you authenticating with a password when you connect to this system? 2) Are you sure that pam_krb5 was the successful PAM module? There are modules before and after pam_krb5 that can succeed. I suspect that it is *not* succeeding, because it is currently set to `optional`, which implies that successful authentication would be ignored. (should be `sufficient`) – Andrew B Jun 29 '17 at 22:56

1 Answers1

1

Figured it out pam_krb5 was missing from the session stack:

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so
session     required      pam_krb5.so

adding session required pam_krb5.so fixed the issue.

Saqib Ali
  • 410
  • 2
  • 7
  • 19
  • 1
    Yep, that would do it. To clarify for future readers, this is entirely dependent on which implementation of `pam_krb` comes bundled with your operating system. The [Russ Allbery implementation](https://www.eyrie.org/~eagle/software/pam-krb5/pam-krb5.html) handles this in the `auth` stack as well as the `session` stack, while others only do so in session. This tends to confuse people. It should be noted that you must *always* have it in the session stack (regardless of implementation) if you are using GSSAPI authentication, as it bypasses the auth stack. That's why I asked about login method. – Andrew B Jul 01 '17 at 22:01