PAM password change failed, pam error 20

 
Thread Tools Search this Thread
Operating Systems Linux SuSE PAM password change failed, pam error 20
# 1  
Old 07-10-2013
PAM password change failed, pam error 20

Hi,

I use a software which can create account on many system or application.

One of resource which is managed by this soft his a server SUSE Linux Enterprise Server 10 (x86_64). patch level 3.

This application which is an IBM application use ssh to launch command to create account in context defined in it.

I have some problem to manage this server and the application display an error of kind Can not set the password useradd fail.

I have displaye the log /var/log/messages that you will find bottom :
Quote:
Jul 10 13:49:26 infra-041 sshd[8694]: Accepted keyboard-interactive/pam for itim from 10.70.10.50 port 2651 ssh2
Jul 10 13:49:26 infra-041 sudo: itim : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/sbin/useradd -u 1192 FRY9AN94
Jul 10 13:49:26 infra-041 useradd[8715]: new account added - account=FRY9AN94, uid=1192, gid=100, home=/home/FRY9AN94, shell=/bin/bash, by=0
Jul 10 13:49:26 infra-041 useradd[8715]: account added to group - account=FRY9AN94, group=video, gid=33, by=0
Jul 10 13:49:26 infra-041 useradd[8715]: account added to group - account=FRY9AN94, group=dialout, gid=16, by=0
Jul 10 13:49:26 infra-041 useradd[8715]: running USERADD_CMD command - script=/usr/sbin/useradd.local, account=FRY9AN94, uid=1192, gid=100, home=/home/FRY9AN94, by=0
Jul 10 13:49:27 infra-041 sshd[8717]: Accepted keyboard-interactive/pam for itim from 10.70.10.50 port 2652 ssh2
Jul 10 13:49:27 infra-041 sudo: itim : TTY=pts/4 ; PWD=/ ; USER=root ; COMMAND=/usr/bin/passwd FRY9AN94
Jul 10 13:49:27 infra-041 passwd[8722]: pam_unix2(passwd:chauthtok): conversation failed
Jul 10 13:49:27 infra-041 passwd[8722]: User root: Authentication token manipulation error
Jul 10 13:49:27 infra-041 passwd[8722]: password change failed, pam error 20 - account=FRY9AN94, uid=1192, by=0
Jul 10 13:49:27 infra-041 sshd[8720]: Received disconnect from 10.70.10.50: 10: General disconnection
Jul 10 13:49:27 infra-041 sudo: itim : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/sbin/userdel FRY9AN94
Jul 10 13:49:27 infra-041 shadow[8723]: running USERDEL_PRECMD command - script=/usr/sbin/userdel-pre.local, account=FRY9AN94, uid=1192, gid=100, home=/home/FRY9AN94, by=0
Jul 10 13:49:27 infra-041 crontab[8725]: (root) DELETE (FRY9AN94)
Jul 10 13:49:27 infra-041 shadow[8723]: account removed from group - account=FRY9AN94, group=video, gid=33, by=0
Jul 10 13:49:27 infra-041 shadow[8723]: account removed from group - account=FRY9AN94, group=dialout, gid=16, by=0
Jul 10 13:49:27 infra-041 shadow[8723]: account deleted - account=FRY9AN94, uid=1192, by=0
Jul 10 13:49:27 infra-041 shadow[8723]: running USERDEL_POSTCMD command - script=/usr/sbin/userdel-post.local, account=FRY9AN94, uid=1192, gid=100, home=/home/FRY9AN94, by=0
Jul 10 13:49:28 infra-041 sshd[8703]: Received disconnect from 10.70.10.50: 10: General disconnection
In this log if i understood, the application create the account in three action :
first ssh to create the account which is succeeded
second ssh to set the password, but it seemes there is a problem with pam module
third ssh to delete the account, because the application cannot change the passwd.

I have some difficulties to know where the problem is exactly met, perhaps you could help me.

I'm sorry for my english but it's not my first language.

Best regards
# 2  
Old 07-10-2013
Did you try ssh -t and ssh -tt to give it a terminal, so your results will match interactive ones? Do you set the environment like .profile in your ssh session or script?
# 3  
Old 07-11-2013
Hi,

Thanks for your help.
The problem is, i haven't the possibility to modify or see how it's implement on the IBM application.

I can only define the user and permission to manage account on the server and define a service about how connect and parameter for an account.
# 4  
Old 07-16-2013
A lot of scripts that want to pass a password are stymied by programs that read the tty for the password, not stdin. Sometimes you need an expect or ssh session to create a terminal from a daemon script with no tty, either on the local system or the remote system. However, if you have no contol over the ssh script or the script it calls, then you are stuck.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. OS X (Apple)

Mac OS X LDAP client not accepting ssh or console logins (PAM error)

Hi Folks, I've install 389 Directory Server on a Centos 7.0 server. Over the last two days I've been trying to connect a MacBook running 10.10.5 to the server as a client and I'm having only partial success. I've "Joined" to my network Account Server, and set my LDAP Mappings to... (2 Replies)
Discussion started by: jlh
2 Replies

2. Linux

Password hardening using pam

Hi We have a requirement to vary the minimum password criteria by the group to which a user belongs. For example a standard user should have a password with a minimum length of 12 and containing a mix of characters whereas an administrator should have a password with a minimum length of 14... (1 Reply)
Discussion started by: gregsih
1 Replies

3. Solaris

Solaris and PAM Password policy

Hello All, I have Sun DSEE7 (11g) on Solaris 10. I have run idsconfig and initialized ldap client with profile created using idsconfig. My ldap authentication works. Here is my pam.conf # Authentication management # # login service (explicit because of pam_dial_auth) # login ... (3 Replies)
Discussion started by: pandu345
3 Replies

4. Solaris

pam sshd error

Hi I wanted to convert my pam libraries to 64 bit. so recently compiled my pam_banner and pam_wheel to 64 bit. I got the following error... sshd: dlsym failed pam_sm_authenticate:error ld.so.1 : sshd fatal: pam_sm_authenticate: can't find symbol thnaks (8 Replies)
Discussion started by: chinchao
8 Replies

5. Solaris

Error opening PAM libraries : solaris 10 on vmware workstation

Hi Admins, I am facing an issue with Solaris 10 sitting on vmware workstation... When I start it, it gives me an error : "Error opening PAM libraries, contact system administrator" Also I can reach it via putty, but none of the id/passwd working. I did revert pam.conf. But still no... (2 Replies)
Discussion started by: snchaudhari2
2 Replies

6. UNIX for Dummies Questions & Answers

Using PAM to log password changes?

Hi, on a lab computer another user (who is a sudoer) changed my password without my permission. I'm pretty positive it was her, though I can't conclusively prove it. I had my friend, who is another sudoer on the machine, fix it and make me a sudoer now too. So everything is fine, but I want... (0 Replies)
Discussion started by: declannalced
0 Replies

7. Solaris

Pam Module sending a cannot get password enry after certain period in /var/adm/messag

Pam Module sending a cannot get password enry after certain period in /var/adm/message. pam_login_limit(auth): Cannot get Password entry for user 'dbsnmp' What is dbsnmp? Also if account is locked does pam module checks for this locked account at regular interval and keeps on posting... (2 Replies)
Discussion started by: student2009
2 Replies

8. Solaris

PAM settings.

Hi Experts, Appended is the pam.conf file in my Sol 5.10 client which uses AD for authentication(Followed scott Lowe's blog on AD-Solaris integration): bash-3.00# cat /etc/pam.conf ##ident "@(#)pam.conf 1.31 07/12/07 SMI" # Copyright 2007 Sun Microsystems, Inc. All rights reserved.... (9 Replies)
Discussion started by: Hari_Ganesh
9 Replies

9. Solaris

PAM, Solaris, Openssh and Forcing a password change

Here's the issue. Currently when I run passwd -f "username" on any account, when I try to login with said account I don't get prompted to change my password I just keep getting prompted to input a password. (Of course this works just fine with telnet)Is there something i need to add to... (7 Replies)
Discussion started by: woodson2
7 Replies

10. UNIX for Advanced & Expert Users

PAM Error messages on Server

Hi, I have CVSNT installed on my Linux machine and sometimes the server goes down with the following error in /var/log/messages. Does anyone know the approach that need to followed to investigate to resolve the same. If so , please let me know. Nov 23 05:57:43 <server ip> cvsnt(pam_unix):... (7 Replies)
Discussion started by: bsandeep_80
7 Replies
Login or Register to Ask a Question