hashicorp / hashicorp/vault-ssh-helper

pam_exec(sshd:auth): execv(expose_authtok,...) failed: No such file or directory

Open
#28 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
447
Forks
56
PR merge metrics
No merged PRs in 30d

Description

I have some issues to get vault-helper to work on a Check Point gateway, R77.30.

The following message appears in `/var/log/messages`:

```
Apr 12 11:03:40 2017 gw-fab738 sshd[6689]: pam_exec(sshd:auth): execv(expose_authtok,...) failed: No such file or directory
Apr 12 11:03:40 2017 gw-fab738 sshd[6671]: pam_exec(sshd:auth): expose_authtok failed: exit code 2
Apr 12 11:03:40 2017 gw-fab738 sshd[6671]: Failed password for admin from 172.16.92.135 port 44234 ssh2
```

This is my sshd PAM file:

```
#%PAM-1.0
#auth include system-auth
auth requisite pam_exec.so debug expose_authtok log=/tmp/vaultssh.log /usr/local/bin/vault-ssh-helper -config=/etc/vault-ssh-helper.d/config.hcl -dev
auth optional pam_unix.so not_set_pass use_first_pass nodelay
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_keyinit.so force revoke
session include system-auth
session required pam_loginuid.so
```

I can execute the `vault-ssh-helper` when I add the `-verify-only` option.

```
2017/04/12 11:07:22 ==> WARNING: Dev mode is enabled!
2017/04/12 11:07:22 [INFO] using SSH mount point: ssh
2017/04/12 11:07:22 [INFO] vault-ssh-helper verification successful!
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the PAM configuration shown in the issue and the /var/log/messages errors on a Check Point R77.30 gateway. Compare the normal authentication invocation of /usr/local/bin/vault-ssh-helper with the successful -verify-only run. Done means SSH authentication works without the pam_exec expose_authtok errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.