[CentOS] cron breaking when enabling ldap

[Gerrard Geldenhuis]

> -----Original Message-----
> From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On
> Behalf Of Gerrard Geldenhuis
> Sent: 14 September 2010 16:28
> To: centos at centos.org
> Subject: [CentOS] cron breaking when enabling ldap
> 
> Hi
> When I enable a box to do authentication using LDAP it breaks cron for
> users like jboss.
> 
> I get the following in /var/log/secure
> Sep 14 15:25:01 exoipatest01 crond[7214]: pam_access(crond:account):
> access denied for user `jboss' from `cron'
> 
> I have the following in /etc/ldap.conf
> nss_initgroups_ignoreusers
> root,ldap,named,avahi,haldaemon,dbus,tomcat,radiusd,news,mailman,nscd,j
> boss
> 
> /etc/pam.d/crond
> auth       sufficient pam_env.so
> auth       required   pam_rootok.so
> auth       include    system-auth
> account    required   pam_access.so
> account    include    system-auth
> session    required   pam_loginuid.so
> session    include    system-auth
> 
> /etc/pam.d/system-auth-ac
> #%PAM-1.0
> # This file is auto-generated.
> # User changes will be destroyed the next time authconfig is run.
> auth        required      pam_env.so
> auth        sufficient    pam_unix.so nullok try_first_pass
> auth        requisite     pam_succeed_if.so uid >= 500 quiet
> auth        sufficient    pam_ldap.so use_first_pass
> auth        required      pam_deny.so
> 
> account     required      pam_access.so
> account     required      pam_unix.so broken_shadow
> account     sufficient    pam_localuser.so
> account     sufficient    pam_succeed_if.so uid < 500 quiet
> account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
> account     required      pam_permit.so
> 
> password    requisite     pam_cracklib.so type= retry=3 difok=3
> minlen=8 dcredit=-1 ocredit=-1 ucredit=-1 lcredit=0
> password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
> use_authtok
> password    sufficient    pam_ldap.so use_authtok
> password    required      pam_deny.so
> 
> session     optional      pam_keyinit.so revoke
> session     required      pam_limits.so
> session     optional      pam_mkhomedir.so
> session     [success=1 default=ignore] pam_succeed_if.so debug service
> in crond quiet use_uid
> session     required      pam_unix.so
> session     optional      pam_ldap.so
> 
> I have added
> + : jboss : cron
> 
> to /etc/security/access.conf which fixes the problem. However I am not
> sure that it is the "correct" fix.
> 
> I would have thought that the string in /etc/ldap.conf
> nss_initgroups_ignoreusers would prevent this error unless I am
> confused about the pam ordering and sequence of how authentication
> happens.
> 
> The cron job executes fine without LDAP enabled.
> 
> Can anyone shed any more light on this error and a possible fix? I am
> using CentOS 5.5 fully updated.
> 
> Best Regards
> 

I have been stupid about this, I realized that I add a - : ALL : ALL when I enable ldap which is not on a box without ldap. Adding this on a box without ldap creates the same error. My fix is thus the correct fix.

Regards

________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from 
MessageLabs to scan all Incoming and Outgoing mail for viruses.

________________________________________________________________________