質問: pbis auth.log要件「user ingroup nopasswdlogin」がユーザー「administrator@domain.local」によって満たされていません windows ad資格情報を使用してubuntu 16.04マシンにログインしたいのですが。 beyondtrustバージョン8.5.2.265のpbis(powerbroker identity services)adブリッジを使用しています。 windows版はwindows server 2012 r2です。これらのエラーは、/ var/log/auth.logにポップアップ表示されます。jan 16 08:34:51 [hostname] lightdm: pam adding faulty module: pam_kwallet5.so jan 16 08:34:59 [hostname] lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "administrator@winsrv.local" jan 16 08:35:01 [hostname] cron[12249]: pam_unix(cron:session): session opened for user root by (uid=0) jan 16 08:35:01 [hostname] cron[12249]: pam_unix(cron:session): session closed for user root jan 16 08:35:03 [hostname] lightdm: [lsass-pam] [module:pam_lsass]user administrator@winsrv.local is denied access because they are not in the 'require membership of' list jan 16 08:35:03 [hostname] lightdm: [lsass-pam] [module:pam_lsass]pam_sm_authenticate error [login:administrator@winsrv.local][error code:40158] jan 16 08:35:07 [hostname] systemd-logind[1050]: removed session c2. / opt/pbis/bin/enum-groupsからコピーしたセキュリティグループ "domain ^ users"と一致するように構成オプションrequiremembershipofを変更しました/ opt/pbis/bin/config --dumpのオプション:allowdeleteto "" allowreadto "" allowwriteto "" maxdiskusage 104857600 maxeventlifespan 90 maxnumevents 100000 domainseparator "\\" spacereplacement "^" enableeventlog false saslmaxbufsize 16777215 providers "activedirectory" displaymotd false pamloglevel "error" usernotallowederror "access denied" assumedefaultdomain true createhomedir true createk5login true syncsystemtime true trimusermembership true ldapsignandseal false logadnetworkconnectionevents true nssenumerationenabled true nssgroupmembersquerycacheonly true nssusermembershipquerycacheonly false refreshusercredentials true cacheentryexpiry 14400 domainmanagercheckdomainonlineinterval 300 domainmanagerunknowndomaincachetimeout 3600 machinepasswordlifespan 2592000 memorycachesizecap 0 homedirprefix "/home" homedirtemplate "%h/%u" remotehomedirtemplate "" homedirumask "022" loginshelltemplate "/bin/bash" skeletondirs "/etc/skel" userdomainprefix "winsrv.local" domainmanagerignorealltrusts false domainmanagerincludetrustslist domainmanagerexcludetrustslist requiremembershipof "domain^users" local_acceptntlmv1 true local_homedirtemplate "%h/local/%d/%u" local_homedirumask "022" local_loginshelltemplate "/bin/sh" local_skeletondirs "/etc/skel" usermonitorcheckinterval 1800 lsassautostart true eventlogautostart true blacklistdc /etc/pam.d/common-sessionファイル:# here are the per-package modules (the "primary" block) session [default=1] pam_permit.so # here's the fallback if no module succeeds session requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around session required pam_permit.so # the pam_umask module will set the umask according to the system default in # /etc/login.defs and user settings, solving the problem of different # umask settings with different shells, display managers, remote sessions etc. # see "man pam_umask". session optional pam_umask.so # and here are more per-package modules (the "additional" block) session optional pam_lsass.so session required pam_unix.so session optional pam_systemd.so session optional pam_ecryptfs.so unwrap # end of pam-auth-update config /etc/pam.d/common-authファイル:# here are the per-package modules (the "primary" block) auth [success=2 default=ignore] pam_lsass.so auth [success=1 default=ignore] pam_unix.so nullok_secure # here's the fallback if no module succeeds auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "additional" block) auth optional pam_ecryptfs.so unwrap # end of pam-auth-update config /etc/pam.d/common-accountファイル:# here are the per-package modules (the "primary" block) account [success=ok new_authtok_reqd=ok default=ignore] pam_lsass.so unknown_ok account [success=2 new_authtok_reqd=done default=ignore] pam_lsass.so account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so # here's the fallback if no module succeeds account requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around account required pam_permit.so # and here are more per-package modules (the "additional" block) # end of pam-auth-update config
回答: 同じ問題を解決しました。持っていた pam_succeed_if(lightdm:auth):要件「user ingroup nopasswdlogin」がユーザー「xxxxxxx」で満たされていません ad認証のある環境では、windows 2016、ubuntu 16.04。ソリューション編集/etc/pam.d/lightdmおよびnopasswdloginをこの行から削除します。auth sufficient pam_succeed_if.so user ingroup nopasswdlogin