Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
Su problem - Wheel okay, SUID okay - [resolved]
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
oezi
n00b
n00b


Joined: 20 Feb 2004
Posts: 5

PostPosted: Fri Feb 20, 2004 9:18 pm    Post subject: Su problem - Wheel okay, SUID okay - [resolved] Reply with quote

Hey everybody!
I finally resort to the forum since I really can't figure it out.


Output from doing su:
Code:

bash-2.05b$ su
Password:
su: Authentication failure
Sorry.

(and yes the password I enter is root's passwd)

Output of call to 'groups'
Code:

bash-2.05b$ groups
wheel audio users slocate


From 'group':
Code:

HisTop etc # less group | grep wheel
wheel:x:10:root,oezi,temp


Passwd file:
Code:

HisTop log # less /etc/passwd | grep oezi
oezi:x:1000:100::/home/oezi:/bin/bash


Access rights:
Code:

HisTop log # ls -l /etc/passwd /etc/shadow /bin/su /sbin/unix_chkpwd
-rwsr-xr-x    1 root     root        24304 Feb 20 04:36 /bin/su
-rw-r--r--    1 root     root         1867 Feb  8 16:48 /etc/passwd
-rw-------    1 root     root          533 Feb  8 16:48 /etc/shadow
-r-sr-xr-x    1 root     root        19088 Feb 20 04:55 /sbin/unix_chkpwd


Pam file:
Code:

HisTop etc # cat pam.d/su
#%PAM-1.0

auth       sufficient   /lib/security/pam_rootok.so

# Uncomment this to allow users in the wheel group to su without entering a passwd.
#auth       sufficient   /lib/security/pam_wheel.so use_uid trust debug

# Comment this to allow any user, even those not in the 'wheel' group to su
auth       required     /lib/security/pam_wheel.so use_uid debug

auth       required     /lib/security/pam_stack.so service=system-auth debug
account    required     /lib/security/pam_stack.so service=system-auth debug
password   required     /lib/security/pam_stack.so service=system-auth debug
session    required     /lib/security/pam_stack.so service=system-auth debug
session    optional     /lib/security/pam_xauth.so


From /var/log/messages:
Code:

Feb 20 06:05:35 HisTop PAM-Wheel[7341]: Ignoring access request 'oezi' for 'root'
Feb 20 06:05:35 HisTop pam_stack[7341]: called for "PAM_AUTHENTICATE"
Feb 20 06:05:35 HisTop pam_stack[7341]: called from "su"
Feb 20 06:05:35 HisTop pam_stack[7341]: initializing
Feb 20 06:05:35 HisTop pam_stack[7341]: creating child stack `system-auth'
Feb 20 06:05:35 HisTop pam_stack[7341]: creating environment
Feb 20 06:05:35 HisTop pam_stack[7341]: NOT passing PAM_AUTHTOK to child: source is NULL
Feb 20 06:05:35 HisTop pam_stack[7341]: passing PAM_CONV to child
Feb 20 06:05:35 HisTop pam_stack[7341]: NOT passing PAM_FAIL_DELAY to child: source not set
Feb 20 06:05:35 HisTop pam_stack[7341]: NOT passing PAM_OLDAUTHTOK to child: source is NULL
Feb 20 06:05:35 HisTop pam_stack[7341]: NOT passing PAM_RHOST to child: source is NULL
Feb 20 06:05:35 HisTop pam_stack[7341]: passing PAM_RUSER to child
Feb 20 06:05:35 HisTop pam_stack[7341]: passing PAM_SERVICE to child
Feb 20 06:05:35 HisTop pam_stack[7341]: passing PAM_TTY to child
Feb 20 06:05:35 HisTop pam_stack[7341]: passing PAM_USER to child
Feb 20 06:05:35 HisTop pam_stack[7341]: NOT passing PAM_USER_PROMPT to child: source is NULL
Feb 20 06:05:35 HisTop pam_stack[7341]: passing data to child
Feb 20 06:05:35 HisTop pam_stack[7341]: calling substack
Feb 20 06:05:39 HisTop unix_chkpwd[7342]: check pass; user unknown
Feb 20 06:05:39 HisTop su(pam_unix)[7341]: authentication failure; logname= uid=1000 euid=1000 tty=pts/0 ruser=oezi rhost=  user=root
Feb 20 06:05:39 HisTop pam_stack[7341]: substack returned 7 (Authentication failure)
Feb 20 06:05:39 HisTop pam_stack[7341]: passing PAM_AUTHTOK to parent
Feb 20 06:05:39 HisTop pam_stack[7341]: NOT passing PAM_CONV to parent: destination already set
Feb 20 06:05:39 HisTop pam_stack[7341]: passing PAM_FAIL_DELAY to parent
Feb 20 06:05:39 HisTop pam_stack[7341]: NOT passing PAM_OLDAUTHTOK to parent: source is NULL
Feb 20 06:05:39 HisTop pam_stack[7341]: NOT passing PAM_RHOST to parent: source is NULL
Feb 20 06:05:39 HisTop pam_stack[7341]: passing PAM_RUSER to parent
Feb 20 06:05:39 HisTop pam_stack[7341]: passing PAM_SERVICE to parent
Feb 20 06:05:39 HisTop pam_stack[7341]: passing PAM_TTY to parent
Feb 20 06:05:39 HisTop pam_stack[7341]: passing PAM_USER to parent
Feb 20 06:05:39 HisTop pam_stack[7341]: NOT passing PAM_USER_PROMPT to parent: source is NULL
Feb 20 06:05:39 HisTop pam_stack[7341]: passing data back
Feb 20 06:05:39 HisTop pam_stack[7341]: passing former back
Feb 20 06:05:39 HisTop pam_stack[7341]: returning 7 (Authentication failure)
Feb 20 06:05:41 HisTop su[7341]: pam_authenticate: Authentication failure
Feb 20 06:05:41 HisTop pam_stack[7341]: freeing stack data for `system-auth' service


What I tried so far:
* Reinstalling pam, pam-login, coreutils, shadow with -O2
* resetting group attributes
* wheel::10:root,oezi (without the x)
* uncommenting the line # auth sufficient /lib/security/pam_wheel.so use_uid trust debug
Code:

bash-2.05b$ su
su: Authentication service cannot retrieve authentication info.
Sorry.

* strace (cannot work because strace does not propagate suid bit)

I'm really desperate... and hope it's not something really stupid :cry:

Please tell me if any information is missing. I really tried to work with all the information available on the web and in the forum.

Christopher


Last edited by oezi on Tue Mar 02, 2004 6:08 pm; edited 1 time in total
Back to top
View user's profile Send private message
oezi
n00b
n00b


Joined: 20 Feb 2004
Posts: 5

PostPosted: Mon Feb 23, 2004 1:49 am    Post subject: SUID in general not workin Reply with quote

Hey Guys!
I tried some other stuff random stuff today, when I noticed that my Ping command doesn't work either when using a non-root user.

Since ICMP-sockets can only be opened by root-users I added SUID bits to ping.

Code:

chmod a+s /bin/ping


But it still doesn't work. Same with mount or umount.

Are maybe in general the SUID-bits broken? Any ideas what else I could try to investigate? Thanks!

Christopher
Back to top
View user's profile Send private message
oezi
n00b
n00b


Joined: 20 Feb 2004
Posts: 5

PostPosted: Tue Mar 02, 2004 6:07 pm    Post subject: Fixed Reply with quote

Okay I found the solution :D

I had a wrong entry in my fstab which disabled suid bits.

Changing the line to

Code:

/dev/hda6       /     reiserfs        noatime              0 1


solved all my problems.

Thanks for having a look at the problem.

Christopher
Back to top
View user's profile Send private message
rosowski
n00b
n00b


Joined: 09 Nov 2003
Posts: 51

PostPosted: Mon Apr 05, 2004 6:58 pm    Post subject: Reply with quote

Did that solve your su issue though? I have the same problem here, after I backed up my system using only cp, without -a option (dumb me...).
My fstab says:

Code:
/dev/hda3               /               ext3            noatime                 0 0


but thats how it came from gentoo, so I guess its right this way.

Cheers,

Daniel
Back to top
View user's profile Send private message
oezi
n00b
n00b


Joined: 20 Feb 2004
Posts: 5

PostPosted: Mon Apr 05, 2004 7:47 pm    Post subject: cp backup Reply with quote

All my Suid-bits for the individual files were set correctly so after I removed the nosuid option from the fstab everthing was working again.

What exactley isn't working? (suid bits, wheel group?)

Best greetings,
Christopher
Back to top
View user's profile Send private message
rosowski
n00b
n00b


Joined: 09 Nov 2003
Posts: 51

PostPosted: Tue Apr 06, 2004 4:58 pm    Post subject: Reply with quote

The point is that I just wonder why you need to set your fstab entry for the root partition from 0 0 to 0 1, since I got it working by setting the suid bit too, but without the changes to the fstab.

Sorry, maybe it was a bit confusing :-)
Back to top
View user's profile Send private message
oezi
n00b
n00b


Joined: 20 Feb 2004
Posts: 5

PostPosted: Tue Apr 06, 2004 5:11 pm    Post subject: nosuid in fstab Reply with quote

I have to be sorry because my bug-fix report was not too clear:

The problem with the fstab was not because of 0 0 vs. 0 1 (these are for file-sys-checks I believe) but because I had "nosuid" (and some other stuff) where "noatime" is now. Check with "man mount" to get the full information on that. Apparently this option is for security reasons to completely disable suid bits at the kernel level.

Christopher
Back to top
View user's profile Send private message
funeagle
Tux's lil' helper
Tux's lil' helper


Joined: 05 Aug 2003
Posts: 95
Location: London

PostPosted: Sat Dec 31, 2005 1:15 pm    Post subject: Reply with quote

Thank you, I had the same problem and now it's solved. But I think you did not tell directly that you had the users entry which disabled the suid bits.

I had it wrong as well:

Code:

/dev/hda6        /               reiserfs        users,exec                    0 0


removed the users and now it works :)
Back to top
View user's profile Send private message
pjp
Administrator
Administrator


Joined: 16 Apr 2002
Posts: 16106
Location: Colorado

PostPosted: Sat Dec 31, 2005 9:44 pm    Post subject: Reply with quote

Moved from Installing Gentoo
_________________
lolgov. 'cause where we're going, you don't have civil liberties.

In Loving Memory
1787 - 2008
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum