0

I've set up a PAM authentication config for OpenVPN.

auth required pam_exec.so debug expose_authtok /opt/openvpn/bin/pamauth

The script pamauth returns 0 on success. I verify this is true by also echoing the value to a file from the pamauth script.

<user authentication process>
echo $EXIT_CODE >/tmp/result       #yields a '0' in /tmp/result
exit $EXIT_CODE

But authentication fails, and the auth.log shows the following, though I can clearly see from /tmp/result that my pamauth script ran and called exit 0

Jul  5 09:53:29 client openvpn: pam_exec(openvpn:auth): send password to child
Jul  5 09:53:29 client openvpn: pam_exec(openvpn:auth): Calling /opt/openvpn/bin/pamauth ...
Jul  5 09:53:29 client openvpn: pam_unix(openvpn:account): could not identify user (from getpwnam(test40))
0

The error message doesn't even mention pam_exec.

Jul  5 09:53:29 client openvpn: pam_unix(openvpn:account): could not identify user (from getpwnam(test40))

The problem is in the account management (account) stage. (If the config for pam.d/openvpn doesn't have any account modules, PAM will use the ones configured in pam.d/other.)

"Could not identify user" here means the pam_unix module could not find the user account test40 in the system. If you have recently edited nsswitch.conf, you might have to restart OpenVPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.