Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've set up a PAM authentication config for OpenVPN.

auth required pam_exec.so debug expose_authtok /opt/openvpn/bin/pamauth

The script pamauth returns 0 on success. I verify this is true by also echoing the value to a file from the pamauth script.

<user authentication process>
echo $EXIT_CODE >/tmp/result       #yields a '0' in /tmp/result
exit $EXIT_CODE

But authentication fails, and the auth.log shows the following, though I can clearly see from /tmp/result that my pamauth script ran and called exit 0

Jul  5 09:53:29 client openvpn: pam_exec(openvpn:auth): send password to child
Jul  5 09:53:29 client openvpn: pam_exec(openvpn:auth): Calling /opt/openvpn/bin/pamauth ...
Jul  5 09:53:29 client openvpn: pam_unix(openvpn:account): could not identify user (from getpwnam(test40))
share|improve this question
up vote 0 down vote accepted

The error message doesn't even mention pam_exec.

Jul  5 09:53:29 client openvpn: pam_unix(openvpn:account): could not identify user (from getpwnam(test40))

The problem is in the account management (account) stage. (If the config for pam.d/openvpn doesn't have any account modules, PAM will use the ones configured in pam.d/other.)

"Could not identify user" here means the pam_unix module could not find the user account test40 in the system. If you have recently edited nsswitch.conf, you might have to restart OpenVPN.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .