hashicorp / hashicorp/vault-ssh-helper

unrecognized option [not_set_pass]

Open
#67 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
447
Forks
56
PR merge metrics
No merged PRs in 30d

Description

Hello,

I have just configured a system SSH OTP.

It looks like the communication with the vault server is working. I found the following in the log /var/log/vault-ssh.log:

```
2022/07/29 13:56:29 [INFO] using SSH mount point: ssh
2022/07/29 13:56:29 [INFO] using namespace:
2022/07/29 13:56:29 [INFO] padmin@141.34.2.17 authenticated!
```

But the PAM log says that not_set_pass is not supported:

```pam_unix(sshd:auth): unrecognized option [not_set_pass]```

I am using an Alma Linux 8 and there is nothing in the man pages (man pam_unix) about this option. I looked in a CentOS 7 system and there is still this option.

I assume that it does not work on the Alma Linux 8 system because of the option. Is it planned that vault-ssh-helper will support REL 8?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing vault-ssh-helper's PAM configuration and comparing the not_set_pass option with Alma Linux 8's pam_unix behavior. Reproduce the reported SSH authentication failure using the vault-ssh.log and PAM messages, then verify compatibility with Alma Linux 8; done when the option works there or the supported configuration is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
authentication, operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.