Using pam_krb5 to change password at ssh prompt gives shell

[Aaron Hicks]

Hello the list,

 

As a workaround for another issue we have with using two-factor
authentication, we're using pam_krb5 to change expired passwords, so in
/etc/pam.d/password-auth-ac whe have changed the password section to be:

 

password    requisite     pam_pwquality.so try_first_pass local_users_only
retry=3 authtok_type=

password    sufficient    pam_unix.so sha512 shadow try_first_pass
use_authtok

#password    sufficient    pam_sss.so use_authtok

password    sufficient    pam_krb5.so chpw_prompt=true use_authok
banner=Retype

 

This puts the user through a password reset process without the second
factor interfering, but at the end they get shell. This is without the
second factor.

 

Is there a parameter this so that the connection is disconnected instead, or
the connection attempt is restarted?

 

I've also tried changing the pam control 'sufficient' from:

 

[success=done new_authtok_reqd=done default=ignore]

 

To 

 

[default=ignore]

 

Regards,

 

Aaron Hicks

[Jochen Hein]

Aaron Hicks via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt;
writes:

>  As a workaround for another issue we have with using two-factor
>  authentication, we're using pam_krb5 to change expired passwords, so in
>  /etc/pam.d/password-auth-ac whe have changed the password section to be:
>  
...
>  This puts the user through a password reset process without the second
>  factor interfering, but at the end they get shell. This is without the
>  second factor.
>
>   
>
>  Is there a parameter this so that the connection is disconnected instead, or
>  the connection attempt is restarted? 
I'd try pam_deny.  This should work for password section.

Jochen

-- 
This space is intentionally left blank.

[Aaron Hicks]

Hi Jochen,

Yes, that pam_deny.so the next line:

password    requisite     pam_pwquality.so try_first_pass local_users_only
retry=3 authtok_type=
password    sufficient    pam_unix.so sha512 shadow try_first_pass
use_authtok
#password    sufficient    pam_sss.so use_authtok # fails with 2FA enabled
password    sufficient    pam_krb5.so chpw_prompt=true use_authok debug=true
[banner=Retype old]
password    required      pam_deny.so

-----Original Message-----
From: Jochen Hein [mailto:[e-mail]] 
Sent: Wednesday, 29 November 2017 6:37 PM
To: Aaron Hicks via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org
>  
Cc: Aaron Hicks <aaron.hicks(a)nesi.org.nz
>  
Subject: Re: [Freeipa-users] Using pam_krb5 to change password
at ssh prompt
gives shell

Aaron Hicks via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org
>  
writes:

>  As a workaround for another issue we have with using two-factor 
>  authentication, we're using pam_krb5 to change expired passwords, so 
>  in /etc/pam.d/password-auth-ac whe have changed the password section to 
be:
>  
...
>  
> This puts the user through a password reset process
without the second 
> factor interfering, but at the end they get shell. This is without the 
> second factor.
>  
>  
>  
> Is there a parameter this so that the connection is
disconnected 
> instead, or the connection attempt is restarted?

I'd try pam_deny.  This should work for password section.

Jochen

--
This space is intentionally left blank.