google / google/google-authenticator-libpam

Permission denied if parent directory of home directory is owned by a different group

Open
#167 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
C
Stars
2k
Forks
305
PR merge metrics
No merged PRs in 30d

Description

Home directories on Lustre seem to be a problem for `pam_google_authenticator`. Attempts to read `.google_authenticator` will always fail with a permission denied. Lustre is exported with `root_squash`. Using the very same home directories mounted via NFS (also exported with `root_squash`) works without problems.

I'm aware that this problem is likely more related to Lustre than to the google authenticator. However, maybe you have an idea what I could try to fix it. My first idea was, that this could be related to issue #166, but that is not the case. Also, we don't use selinux.

```
Mai 26 11:31:18 login sshd(pam_google_authenticator)[20414]: Failed to read "/home/testuser/.google_authenticator" for "testuser": Permission denied
```

The permissions of the file are as expected. SSH is also able to read the `authorized_keys` file from the Lustre-Home without problems. So in general switching the user ID and reading a file from Lustre works during SSH login, but not for the google authenticator. Any ideas what SSH itself is doing differently from `pam_google_authenticator`?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.