FS#61305 - [pambase] 20190105.1-1: ssh login denied (pam_open_session(): Cannot make/remove an entry for the sp

Attached to Project: Arch Linux
Opened by Christoph Fink (peippo) - Tuesday, 08 January 2019, 12:57 GMT
Last edited by Dave Reisner (falconindy) - Tuesday, 08 January 2019, 18:46 GMT
Task Type Bug Report
Category Packages: Testing
Status Closed
Assigned To No-one
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
After the update of pambase to 20190105.1-1 I cannot login via ssh (which previously worked)

journalctl -u sshd shows the following error:
pam_warn(sshd:session): function=[pam_sm_open_session] flags=0 service=[sshd] terminal=[ssh] user=[RETRACTED] ruser=[<unknown>] rhost=[RETRACTED]
error: PAM: pam_open_session(): Cannot make/remove an entry for the specified session

If I revert /etc/pam.d/other to its 20171006-1 version (pam_unix.so instead of pam_deny.so and pam_warn.so), ssh login works as expected

Additional info:
pambase-20190105.1-1
pam-1.3.1-1
openssh 7.9p1-1
machine is a KVM guest


Steps to reproduce:
Update pambase, try to login via ssh
This task depends upon

Closed by  Dave Reisner (falconindy)
Tuesday, 08 January 2019, 18:46 GMT
Reason for closing:  Not a bug
Additional comments about closing:  user configuration error
Comment by Christoph Fink (peippo) - Tuesday, 08 January 2019, 13:04 GMT
I narrowed it down to the lines in /etc/pam.d/other referring to the session, commenting out the two lines

#session required pam_deny.so
#session required pam_warn.so

and adding

session required pam_unix.so

is a working work around
Comment by Jake Kreiger (Magali75) - Tuesday, 08 January 2019, 14:55 GMT
@peippo that change in /etc/pam.d/other was intended, see https://bugs.archlinux.org/task/48650 .
Comment by loqs (loqs) - Tuesday, 08 January 2019, 15:54 GMT
What supplied the sshd binary? sshd from openssh uses etc/pam.d/sshd supplied in the openssh package.
Comment by Christoph Fink (peippo) - Tuesday, 08 January 2019, 18:21 GMT
Thanks for the quick reaction.

I do now understand how other is supposed to deny access. I am using openssh from core, in version 7.9p1-1, and reinstalling the package did not change the behaviour.

I found now to my own surprise, though, that the session line in /etc/pam.d/sshd was commented out. This solved the issue completely, thanks for your help!

Loading...