Alan McKinnon wrote:
On Sunday 03 May 2009 04:53:41 Mike Kazantsev wrote:
On Sat, 02 May 2009 20:52:39 -0400

I don't know about motd, but the rest looks like pam problem to me, if
you're using pam, of course. Try 'euse -i pam' to see if it's enabled.

If that's the case, first of all I'd suggest to check etc-update.
Then look through /etc/pam.d, especially system-* files. There you can
remove some of the required (for successfull authentication) modules,
so their failure won't affect the process.

And read the elogs. There's been some pam updates come through on my machines the last few weeks/months.


I re-emerged pam and following this message:

--------------
LOG: postinst
Starting from version 20080801, pambase optionally enables
SHA512-hashed passwords. For this to work, you need sys-libs/pam-1.0.1
built against sys-libs/glibc-2.7 or later.
If you don't have support for this, it will automatically fallback
to MD5-hashed passwords, just like before.

Please note that the change only affects the newly-changed passwords
and that SHA512-hashed passwords will not work on earlier versions
of glibc or Linux-PAM.
--------------

I edited /etc/login.defs

----------------
# This variable is deprecated. You should use ENCRYPT_METHOD.
#
#MD5_CRYPT_ENAB yes

# Note: If you use PAM, it is recommended to use a value consistent with
# the PAM modules configuration.
#
#ENCRYPT_METHOD DES
ENCRYPT_METHOD SHA512
-------------------

since I find this in /etc/pam.d/system-auth

------------
password required pam_unix.so try_first_pass use_authtok nullok sha512 shadow
--------------

After these changes (do I need to reboot? I am doing this remotely so I will have to wait till I can sit on the console) still can't login or su to 3 of the accounts. Also created a new account and no luck login to to it nor using su. Apparently newly created accounts definitely are affected. Older accounts still work (???)

I have used a debug option on the pam modules but didn't manage to get additional info in the /var/log/message file.

Thanks for any suggestions.

--
Valmor

Reply via email to