Re: [Vserver] problems with sshd/pam inside vserver guest

From: Herbert Poetzl <herbert_at_13thfloor.at>
Date: Thu 13 Oct 2005 - 22:51:26 BST
Message-ID: <20051013215126.GC18342@MAIL.13thfloor.at>

On Thu, Oct 13, 2005 at 09:50:52AM -0700, Eric Jorgensen wrote:
> --- Guenther Fuchs <vserver@muh.at> wrote:
>
> > Hi there,
> >
> > on Thursday, October 13, 2005 at 18:14 on the list
> > was posted:
> >
> > > I'm running 2.6.12.4-vs2.0 on a Fedora Core 4 box,
> > > with a Fedora Core 4 guest.
> >
> > Have some of this here, same (x86_64 edition).
> >
> > > From /var/log/secure:
> >
> > What does /var/log/messages say?
>
> Oct 13 12:06:02 v015 pam_loginuid[24431]: set_loginuid
> failed opening loginuid
> Oct 13 12:06:02 v015 pam_loginuid[24431]: set_loginuid
> failed
>
> > > Oct 13 12:06:02 v015 sshd[24431]: error: PAM:
> > > pam_open_session(): Cannot make/remove an entry
> > for
> > > the specified session
> >
> > This sounds like the same problem I had - after
> > googling the messages
> > entry I found out, that commenting out the
> > "pam_loginuid.so" in
> > /etc/pam.d/* is necessary, as this does not load /
> > exist.
> >
> > Let us know if this works.
>
> Yes, that worked beautifully! I am now able to login
> to the guest remotely via ssh.

JFYI: here is the explanation:

there is something called linux kernel auditing (which
can be used for various things, and this got so popular
(although it has some design flaws) that userspace of
some distros was modified to tell the kernel which uid
did start what session (working around one of the flaws)
unfortunately that framework is not virtualized yet,
but enabled by default, which causes the issues you
experienced ...

removing the pam module is the best known solution for
now, as it is unlikely that you will use the audit
framework ....

best,
Herbert

> Thanks!
>
> jorgy
>
> _______________________________________________
> Vserver mailing list
> Vserver@list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver@list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver
Received on Thu Oct 13 22:51:51 2005

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Thu 13 Oct 2005 - 22:51:56 BST by hypermail 2.1.8