Sam Morris via FreeIPA-users <freeipa-users@lists.fedorahosted.org> writes:
> On 21/09/2023 08:55, Sirio Sannipoli via FreeIPA-users wrote: >> Thanks so much Sumit, >> your suggestion works perfectly. >> I'm still curious about the difference in behavior between >> distributions, but it's not that important. >> Greetings > > Probably on RHEL you have pam_sssd in your PAM stack, which is able to > present separate prompts for both factors; whereas on Debian you have > pam_unix which can only present a "Password:" prompt. > > This happens because pam_unix is registered in Debian's > pam-auth-update mechanism with priority 256, whereas pam_sss is only > registred with priority 128. Thus, the 'common-auth' PAM stack (which > is included by sshd, login, gdm, etc) has pam_auth.so first, which > prompts for the password; then pam_sss.so is called, with the > 'use_first_pass' option, so it uses the password stashed by > pam_unix.so instead of presenting its own prompts. > > I think pam_sss's priority should be bumped but I've not gotten around > to chasing this request: > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001644 Thanks for opening the bug - I think that's the right thing to do. As a workaround I prepare a file /usr/share/pam-configs/unix+sss with the config I wanted and enable that instead of "unix" in pam-auth-update. Jochen -- This space is intentionally left blank. _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
