Did you set an allowed group ?
Also yeah, I think it was heartbleed that caused a lot of panic and initial forks like libressl, but it also prompted a lot of investwent into openssl and it's actually gotten a lot better since.
Where libressl seems to have languished
Heck, openssl 3.0.0 today
Yeah
@trissylegs When you say you can't authenticate what's the actual logs or symptmos from a login attempt? Can users resolve with getent passwd <name>?
That's why it's there
I use name as well at home too
the spn thing is meant for future proofing when (if?) i add trusts
% cat /etc/kanidm/unixd
# this should be at /etc/kanidm/unixd, and configures kanidm-unixd
# some documentation is here: https://github.com/kanidm/kanidm/blob/master/kanidm_book/src/pam_and_nsswitch.md
pam_allowed_login_groups = ["humans"]
# default_shell = "/bin/bash"
home_prefix = "/home/"
home_attr = "uuid"
home_alias = "name"
uid_attr_map = "name"
gid_attr_map = "name"
Oh this is the message I get:
$ su -l nirya
Password:
su: Authentication service cannot retrieve authentication info
Okay, so the next steps would be
systemctl edit kanidm-unix.service
[Service]
Environment="RUST_LOG=kanidm=debug"in pam, on lines with pam_kanidm.so, add the option debug
Then restart kanidm-unixd, and try su again.
Youll have more info in journalctl, and it prints more to the TTY from the pam module.
But after that I'll need to see your /etc/pam.d/su and probably other fules.
files*
There is a troubleshooting section here which is honestly what I'm reading XD
I think it'll be something in /etc/pam.d
Pam is really tricky and delicate at the best of times :(
content of /etc/pam.d/su ?
It may have include statements, so if those are present, can you provide those files too?
% cat su
#%PAM-1.0
auth sufficient pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth sufficient pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth required pam_wheel.so use_uid
auth required pam_unix.so
account required pam_unix.so
session required pam_unix.so
password include system-authpam.d/su-l is identical
So it only allows local accounts.
It's content would likely be more alligned to what you want here.