google / google/google-authenticator-libpam

OTP verification fails on AIX

Open
#100 13 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
2k
Forks
305
PR merge metrics
No merged PRs in 30d

Description

We've compiled the project on AIX 7.1
had to include gnulib and run
```
./gnulib-tool --import getopt
./gnulib-tool --add-import getopt-gnu
./gnulib-tool --add-import vasprintf
```
and a couple other tweaks to compile sucessfully.
running google-authenticator works and creates the .google_authenticator file

AIX uses /etc/pam.conf rather than /etc/pam.d/sshd
in pam.conf added the second line
```
sshd auth required pam_aix
sshd auth required pam_google_authenticator.so nullok
```
at this point I can attempt to connect to the AIX server and receive the prompts you would expect
```
homer[sc2112] ssh goob@gahost
goob's Password:
Verification code:
Connection closed by 192.168.14.75
homer[sc2112]

```

The connection immediately closes.
If I remove the users .google_authenticator file the connection succeeds, obviously without the "Verification code:" prompt.

In the syslog after the connection with verification code it has this

```
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: pam_start(sshd goob)
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: pam_set_item(1)
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: pam_set_item(2)
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: pam_set_item(5)
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: pam_set_item(4)
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: pam_set_item(5)
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: pam_authenticate()
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: load_modules: /usr/lib/security/pam_aix
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: load_function: successful load of pam_sm_authenticate
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: load_modules: /usr/lib/security/pam_google_authenticator.so
Jul 2 14:32:04 gahost auth|security:debug sshd: PAM: load_function: successful load of pam_sm_authenticate
Jul 2 14:32:07 gahost auth|security:debug sshd: PAM: pam_set_item(6)
```

Also, if I add more options to the pam.conf entry for google authenticator, for example

`sshd auth required pam_google_authenticator.so nullok debug`

The login process goes like this

```
homer[sc2112] ssh wally@stryker
goob's Password:
goob's Password:
goob's Password:
goob@gahost's password:
Connection closed by 192.168.14.75
homer[sc2112]
```

and the syslog has this

```
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: pam_start(sshd goob)
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: pam_set_item(1)
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: pam_set_item(2)
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: pam_set_item(5)
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: pam_set_item(4)
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: pam_set_item(5)
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: pam_authenticate()
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: load_modules: /usr/lib/security/pam_aix
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: load_function: successful load of pam_sm_authenticate
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: load_modules: /usr/lib/security/pam_google_authenticator.so
Jul 2 15:00:51 gahost auth|security:debug sshd: PAM: load_function: successful load of pam_sm_authenticate
Jul 2 15:00:54 gahost auth|security:debug sshd: PAM: pam_set_item(6)
Jul 2 15:00:54 gahost auth|security:info syslog: ssh: failed login attempt for goob from homer
Jul 2 15:00:54 gahost auth|security:debug sshd: PAM: pam_set_item(5)
Jul 2 15:00:54 gahost auth|security:debug sshd: PAM: pam_authenticate()
Jul 2 15:00:54 gahost auth|security:debug sshd: PAM: load_modules: /usr/lib/security/pam_aix
Jul 2 15:00:54 gahost auth|security:debug sshd: PAM: load_function: successful load of pam_sm_authenticate
Jul 2 15:00:54 gahost auth|security:debug sshd: PAM: load_modules: /usr/lib/security/pam_google_authenticator.so
Jul 2 15:00:54 gahost auth|security:debug sshd: PAM: load_function: successful load of pam_sm_authenticate
Jul 2 15:00:58 gahost auth|security:debug sshd: PAM: pam_set_item(6)
Jul 2 15:00:58 gahost auth|security:info syslog: ssh: failed login attempt for goob from homer
Jul 2 15:00:58 gahost auth|security:debug sshd: PAM: pam_set_item(5)
Jul 2 15:00:58 gahost auth|security:debug sshd: PAM: pam_authenticate()
Jul 2 15:00:58 gahost auth|security:debug sshd: PAM: load_modules: /usr/lib/security/pam_aix
Jul 2 15:00:58 gahost auth|security:debug sshd: PAM: load_function: successful load of pam_sm_authenticate
Jul 2 15:00:58 gahost auth|security:debug sshd: PAM: load_modules: /usr/lib/security/pam_google_authenticator.so
Jul 2 15:00:58 gahost auth|security:debug sshd: PAM: load_function: successful load of pam_sm_authenticate
Jul 2 15:01:00 gahost auth|security:debug sshd: PAM: pam_set_item(6)
Jul 2 15:01:01 gahost auth|security:info syslog: ssh: failed login attempt for goob from homer
Jul 2 15:01:04 gahost auth|security:debug sshd: PAM: pam_set_item(5)
Jul 2 15:01:04 gahost auth|security:debug sshd: PAM: pam_authenticate()
Jul 2 15:01:04 gahost auth|security:debug sshd: PAM: load_modules: /usr/lib/security/pam_aix
Jul 2 15:01:04 gahost auth|security:debug sshd: PAM: load_function: successful load of pam_sm_authenticate
Jul 2 15:01:04 gahost auth|security:debug sshd: PAM: load_modules: /usr/lib/security/pam_google_authenticator.so
Jul 2 15:01:04 gahost auth|security:debug sshd: PAM: load_function: successful load of pam_sm_authenticate
Jul 2 15:01:04 gahost auth|security:debug sshd: PAM: pam_set_item(6)

```

Any ideas how to fix this would be appreciated.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.