hashicorp / hashicorp/vault-ssh-helper
pam_exec(sshd:auth): execv(expose_authtok,...) failed: No such file or directory
- Dominant language
- Go
- Stars
- 447
- Forks
- 56
- PR merge metrics
- No merged PRs in 30d
Description
I have some issues to get vault-helper to work on a Check Point gateway, R77.30.
The following message appears in `/var/log/messages`:
```
Apr 12 11:03:40 2017 gw-fab738 sshd[6689]: pam_exec(sshd:auth): execv(expose_authtok,...) failed: No such file or directory
Apr 12 11:03:40 2017 gw-fab738 sshd[6671]: pam_exec(sshd:auth): expose_authtok failed: exit code 2
Apr 12 11:03:40 2017 gw-fab738 sshd[6671]: Failed password for admin from 172.16.92.135 port 44234 ssh2
```
This is my sshd PAM file:
```
#%PAM-1.0
#auth include system-auth
auth requisite pam_exec.so debug expose_authtok log=/tmp/vaultssh.log /usr/local/bin/vault-ssh-helper -config=/etc/vault-ssh-helper.d/config.hcl -dev
auth optional pam_unix.so not_set_pass use_first_pass nodelay
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
```
I can execute the `vault-ssh-helper` when I add the `-verify-only` option.
```
2017/04/12 11:07:22 ==> WARNING: Dev mode is enabled!
2017/04/12 11:07:22 [INFO] using SSH mount point: ssh
2017/04/12 11:07:22 [INFO] vault-ssh-helper verification successful!
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the PAM configuration shown in the issue and the /var/log/messages errors on a Check Point R77.30 gateway. Compare the normal authentication invocation of /usr/local/bin/vault-ssh-helper with the successful -verify-only run. Done means SSH authentication works without the pam_exec expose_authtok errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100