Ok, habe folgendes herausgefunden:
Hier wird die Fehlermeldung an den Syslog gegeben:
Code: Alles auswählen
static void cleanup(pam_handle_t *pamh, void *data, int err) {
if (NULL != data) {
abl_args *args = data;
log_debug(args, "In cleanup, err is %08x", err);
if (err && (err & PAM_DATA_REPLACE) == 0) {
record_attempt(args);
}
config_free(args);
free(args);
}
}
Die Funktion cleanup() wird in der PAM-Docu wie folgt beschrieben:
...
PAM modules may be dynamically loadable objects. In general such files should not contain static variables. This function and its counterpart pam_get_data(3), provide a mechanism for a module to associate some data with the handle pamh. Typically a module will call the pam_set_data function to register some data under a (hopefully) unique module_data_name. The data is available for use by other modules too but not by an application. Since this functions stores only a pointer to the data, the module should not modify or free the content of it.
...
The function cleanup() is associated with the data and, if non-NULL, it is called when this data is over-written or following a call to pam_end(3).
...
Quelle:
PAM Doku
In der security/pammodules.h finde ich folgendes:
Code: Alles auswählen
/*
* here are some proposed error status definitions for the
* 'error_status' argument used by the cleanup function associated
* with data items they should be logically OR'd with the error_status
* of the latest return from libpam -- new with .52 and positive
* impression from Sun although not official as of 1996/9/4 there are
* others in _pam_types.h -- they are for common module/app use.
*/
#define PAM_DATA_REPLACE 0x20000000 /* used when replacing a data item */
Im Logfile erscheint folgendes:
Code: Alles auswählen
Jun 29 13:43:03 hostB pam_abl[5808]: pam_sm_authenticate(), flags=00000001
Jun 29 13:43:03 hostB pam_abl[5808]: /etc/security/pam_abl.conf: user_db=/var/lib/abl/users.db
Jun 29 13:43:03 hostB pam_abl[5808]: /etc/security/pam_abl.conf: user_purge=2d
Jun 29 13:43:03 hostB pam_abl[5808]: /etc/security/pam_abl.conf: user_rule=!root:3/1h,30/1d
Jun 29 13:43:03 hostB pam_abl[5808]: Checking user userA
Jun 29 13:43:03 hostB pam_abl[5808]: /var/lib/abl/users.db opened
Jun 29 13:43:03 hostB sshd[5808]: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=hostname.de user=userA
Jun 29 13:43:05 hostB sshd[5808]: Failed password for userA from 123.123.123.123 port 40236 ssh2
Jun 29 13:43:14 hostB pam_abl[5808]: pam_sm_authenticate(), flags=00000001
Jun 29 13:43:14 hostB pam_abl[5808]: /etc/security/pam_abl.conf: user_db=/var/lib/abl/users.db
Jun 29 13:43:14 hostB pam_abl[5808]: /etc/security/pam_abl.conf: user_purge=2d
Jun 29 13:43:14 hostB pam_abl[5808]: /etc/security/pam_abl.conf: user_rule=!root:3/1h,30/1d
Jun 29 13:43:14 hostB pam_abl[5808]: In cleanup, err is 20000000
Jun 29 13:43:14 hostB pam_abl[5808]: Checking user userA
Jun 29 13:43:14 hostB pam_abl[5808]: /var/lib/abl/users.db opened
Jun 29 13:43:16 hostB sshd[5808]: Failed password for userA from 123.123.123.123 port 40236 ssh2
Beachtet, dass der Cleanup Error erst auftritt, wenn man das Passwort das zweite mal falsch eingibt (mit ssh kann man 3 mal pro session einen login probieren). Dabei wird die Funktion pam_sm_authenticate() aufgerufen, die wiederum irgendwo pam_set_data() aufruft. Und genau an der stelle Entsteht die Fehlermeldung.
Bin mir noch nicht ganz sicher was das bedeutet, aber ich suche mal weiter.
Sascha
