I upgraded to 16.04 from 2.x, and now I can't authenticate using pam.
I switched to internal authentication as a test, and it all works fine.
I think I traced the problem to the epam helper program.
Here is my xmpp pam service file: (I added pam_warn.so to get log messages)
# File autogenerated by pamd_mimic in pam eclass auth required pam_warn.so auth include system-auth account include system-auth
I used the pamtester program (from here:
pamtester -I ruser=me xmpp me authenticate Password: pamtester: successfully authenticated
When I do that, this shows up in syslog:
Aug 26 10:36:29 hostname pamtester: pam_warn(xmpp:auth): function=[pam_sm_authenticate] flags=0 service=[xmpp] terminal=[] user=[me] ruser=[me] rhost=[]
But when I try to log in using Pidgin, this is what shows up in syslog:
Aug 26 10:39:20 hostname epam: pam_warn(xmpp:auth): function=[pam_sm_authenticate] flags=0 service=[xmpp] terminal=[] user=[me] ruser=[me] rhost=[] Aug 26 10:39:20 hostname unix_chkpwd[11274]: check pass; user unknown Aug 26 10:39:20 hostname unix_chkpwd[11275]: check pass; user unknown Aug 26 10:39:20 hostname unix_chkpwd[11275]: password check failed for user (me) Aug 26 10:39:20 hostname epam: pam_unix(xmpp:auth): authentication failure; logname= uid=103 euid=103 tty= ruser=me rhost= user=me
Notice that the first line contains the same information as the entry from pamtester, in particular the same user name.
It looks like epam isn't passing the user name correctly.
Is there any way I can see what it's doing? Or does anyone have any ideas?
The issue was that epam
The issue was that epam wasn't running as root.
I'd seen that this needed to be done in the documentation, but did not realize that ejabberd starts epam and leaves it running. So when I toggled it initially, it didn't seem to have any effect.
I had to shut down the server, then do the chmod, then restart to get it all to work.
I ran into this same issue
I ran into this same issue when upgrading from Fedora 22 to Fedora 24.
Fedora now packages epam in the erlang-p1_pam package, which I have installed - but I can find no instructions on how to configure ejabberd to start epam.
I found this Fedora issue
I found this Fedora issue related to ejabberd and epam:
https://bugzilla.redhat.com/show_bug.cgi?id=1337216
And I posted a workaround there - make epam setuid root as the ejabberd instructions enumerate:
chmod 4750 /usr/lib/erlang/lib/p1_pam-1.0.0/priv/bin/epam
Aha thanks! I've been banging
Aha thanks!
I've been banging my head on this since I upgraded last night.
I found out that on my Gentoo install there are 2 copies of epam and apparently ejabberd uses both for different things. I had already fixed the one in the ejabberd directory (which resolved several errors), but not the other one you mentioned (which fixed actual auth).
Quote: I found out that on my
I found out that on my Gentoo install there are 2 copies of epam
This sounds like a Gentoo packaging issue.