Re: [Cooker] Re: Cooker Login Fail after daily Update

[Vincent Danen]

* [2008-05-20 18:55:50 +0200] Moreno wrote:

> > > > > These are my configurations file
> > > >
> > > > /etc/login.def should still work even without the TCB stuff.  login.def
> > > > is used when creating new accounts, so shouldn't prevent you from
> > > > logging in.  That's strictly pam-related.
> > > >
> > > > Did you make changes to /etc/login.def?  I didn't think too many people
> > > > would have made changes to that file so I didn't worry about doing some
> > > > kind of "migration magic" in the spec to handle it, as I did with
> > > > system-auth (granted, that was in a pam update that came a few hours
> > > > after the original tcb-aware one came out).
> > >
> > > No i do not have do any modification inside these configuration file.
> > >
> > > I have updated an other machine with the same effect.
> >
> > Which version of pam do you have installed?  10mdv should transparently
> > migrate the system-auth file; I just upgraded it here and it worked
> > flawlessly.
> >
> > This is most likely due to msec tampering with the system-auth file,
> > which is making rpm think the file has changed (which it had), thus
> > creating the .rpmnew file.  With 10mdv, however, the pam package does
> > the migration so you shouldn't be locked out.
> >
> > On my test system, which is using LDAP for auth so I had made changes
> > for LDAP auth, I was only locked out of local accounts -- LDAP
> > authentication still worked and so did logins as root.
>
> Here the list of installed packages
> passwd-0.7.4-3
> apache-conf-2.2.8-5
> pm-utils-0.99.4-4
> pam-0.99-8.1-9
> hylafax-5.24-1
> libhylafax5-5.24-1
> pam-tcb-1.0.2-2
> util-linux-ng-2.13.1-6
> tcb-1.0.2-2
> nss-tcb-1.0.2-2
> shadow-utils-4.0.12-13
> libtcb0-1.0.2-2
> setup-2.7.12-2
>
> The release 10 of pam was released after I updated the machine.

Yeah, there was a period of a few hours as I tried to find the most
elegant solution to fix the problem where 9mdv could have been installed
and resulted in the behaviour you had.  10mdv fixes that, regardless of
whether you previously had pam 8mdv or 9mdv installed.

--
Vincent Danen @ http://linsec.ca/

Attachment: pgp00083.pgp
Description: PGP signature