Okay, so the next steps would be
systemctl edit kanidm-unix.service
[Service]
Environment="RUST_LOG=kanidm=debug"in pam, on lines with pam_kanidm.so, add the option debug
Then restart kanidm-unixd, and try su again.
Youll have more info in journalctl, and it prints more to the TTY from the pam module.
But after that I'll need to see your /etc/pam.d/su and probably other fules.
files*
There is a troubleshooting section here which is honestly what I'm reading XD
I think it'll be something in /etc/pam.d
Pam is really tricky and delicate at the best of times :(
content of /etc/pam.d/su ?
It may have include statements, so if those are present, can you provide those files too?
% cat su
#%PAM-1.0
auth sufficient pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth sufficient pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth required pam_wheel.so use_uid
auth required pam_unix.so
account required pam_unix.so
session required pam_unix.so
password include system-authpam.d/su-l is identical
So it only allows local accounts.
It's content would likely be more alligned to what you want here.
It's includidng system auth
Honestly, I don't use su much, I use sudo,
But I'd say that would be your issue
But getting closer :)
But .....
$ sudo --user=nirya --login
We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
#1) Respect the privacy of others.
#2) Think before you type.
#3) With great power comes great responsibility.
[sudo] password for safety:
acct_mgmt
args -> ["debug", "ignore_unknown_user"]
opts -> Options { debug: true, use_first_pass: false, ignore_unknown_user: true }
Yeah,
Like I said, that su file, only allows pam_unix
I think tty goes though /etc/pam.d/login