Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've set up a PAM authentication config for OpenVPN.

auth required pam_exec.so debug expose_authtok /opt/openvpn/bin/pamauth

The script pamauth returns 0 on success. I verify this is true by also echoing the value to a file from the pamauth script.

<user authentication process>
echo $EXIT_CODE >/tmp/result       #yields a '0' in /tmp/result
exit $EXIT_CODE

But authentication fails, and the auth.log shows the following, though I can clearly see from /tmp/result that my pamauth script ran and called exit 0

Jul  5 09:53:29 client openvpn: pam_exec(openvpn:auth): send password to child
Jul  5 09:53:29 client openvpn: pam_exec(openvpn:auth): Calling /opt/openvpn/bin/pamauth ...
Jul  5 09:53:29 client openvpn: pam_unix(openvpn:account): could not identify user (from getpwnam(test40))
share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

The error message doesn't even mention pam_exec.

Jul  5 09:53:29 client openvpn: pam_unix(openvpn:account): could not identify user (from getpwnam(test40))

The problem is in the account management (account) stage. (If the config for pam.d/openvpn doesn't have any account modules, PAM will use the ones configured in pam.d/other.)

"Could not identify user" here means the pam_unix module could not find the user account test40 in the system. If you have recently edited nsswitch.conf, you might have to restart OpenVPN.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.