Arch Linux

Added some people who might be able to answer my questions.

Have you possibly done any research into this? PAM is not my forte, but I don't see any glaring differences when compared to an ubuntu box here, besides the nullok_secure stuff which is debian specific.

Ideas?

I just read your comment at the forums and added the mentioned options to the config.

This is the only message i get when specifying a nonexistant user:

login[4780]: FAILED LOGIN (1) on 'vc/1' FOR `UNKNOWN', User not known to the underlying authentication module
login[4780]: FAILED LOGIN (2) on 'vc/1' FOR `UNKNOWN', User not known to the underlying authentication module
login[4865]: FAILED LOGIN (3) on 'vc/1' FOR `UNKNOWN', User not known to the underlying authentication module
login[4865]: FAILED LOGIN (4) on 'vc/1' FOR `UNKNOWN', User not known to the underlying authentication module

Its the same message that appears when trying it without any username (just pressing enter)

I'll try to look some more into this, but i have zero experience with pam...

Eliott mentioned to me that our password stanzas are commented out. Could you try uncommenting the password stanza in /etc/pam.d/login that uses pam_unix.so ?

Uncommented this line in /etc/pam.d/login:

password required pam_unix.so md5 shadow use_authtok

Rebootet (just to be sure), but still no go and the same message in the logs

The securetty line in /etc/pam.d/login needs to be changed from 'requisite' to 'required'. Working as expected here with that change, if someone else can confirm, that would be good.

.... and reassigned to those I just robbed it from :) I'm not that greedy, really....

Works for me, thanks :-)

Just for completeness, here is how my /etc/pam.d/login looks now:

#%PAM-1.0
auth required pam_securetty.so
auth requisite pam_nologin.so
auth required pam_unix.so nullok
auth required pam_tally.so onerr=succeed file=/var/log/faillog
# use this to lockout accounts for 10 minutes after 3 failed attempts
#auth required pam_tally.so deny=2 unlock_time=600 onerr=succeed file=/var/log/faillog
account required pam_access.so
account required pam_time.so
account required pam_unix.so
#password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3
password required pam_unix.so md5 shadow use_authtok
session required pam_unix.so
session required pam_env.so
session required pam_motd.so
session required pam_limits.so
session optional pam_mail.so dir=/var/spool/mail standard
session optional pam_lastlog.so

Lets add one more assignee!

Tpowa, could you fix this asap? It's pretty important. If not then one of us can get to it, thanks to TomK

While on the topic, I just peeked and we have like 5 dead patches in CVS - can you remove those too?

could someone else look at it i have no time atm

I'll do it. /etc/pam.d/login belongs to shadow, so it's a simple edit and bump.