关于/var/log/secure日志问题

haohaodeshijie

当我在做su到root的时候，一直提示密码不正确，但是我在本地登录的时候，是可以登陆的，所以排除密码错误问题！怀疑是/etc/pam.d/su的配置问题，我也还原原来的备份su文件，依然无法su到root用户下，而且现在从远程登录root用户后，也无法su到普通用户下，提示：could not open session
以下是我/etc/pam.d/su的配置：哪位高手帮忙看下什么问题！！
#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth           required        pam_wheel.so use_uid
auth            include         system-auth
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         include         system-auth
session         optional        pam_xauth.so


查看/var/log/secure的日志：
Aug 11 16:59:31 manager su: PAM (su) illegal module type: i
Aug 11 16:59:31 manager su: PAM (su) no control flag supplied
Aug 11 16:59:31 manager su: PAM (su) no module name supplied
Aug 11 16:59:31 manager su: PAM (su) illegal module type: i
Aug 11 16:59:31 manager su: PAM (su) no control flag supplied
Aug 11 16:59:31 manager su: PAM (su) no module name supplied
Aug 11 16:59:31 manager su: PAM (su) illegal module type: i
Aug 11 16:59:31 manager su: PAM (su) no control flag supplied
Aug 11 16:59:31 manager su: PAM (su) no module name supplied
Aug 11 16:59:31 manager su: PAM (su) illegal module type: i
Aug 11 16:59:31 manager su: PAM (su) no control flag supplied
Aug 11 16:59:31 manager su: PAM (su) no module name supplied
Aug 11 16:59:34 manager su: pam_unix(su:auth): authentication failure; logname=fsti uid=500 euid=0 tty=pts/0 ruser=fsti rhost=  user=root
Aug 11 16:59:38 manager su: PAM (su) illegal module type: i
Aug 11 16:59:38 manager su: PAM (su) no control flag supplied
Aug 11 16:59:38 manager su: PAM (su) no module name supplied
Aug 11 16:59:38 manager su: PAM (su) illegal module type: i
Aug 11 16:59:38 manager su: PAM (su) no control flag supplied
Aug 11 16:59:38 manager su: PAM (su) no module name supplied
Aug 11 16:59:38 manager su: PAM (su) illegal module type: i
Aug 11 16:59:38 manager su: PAM (su) no control flag supplied
Aug 11 16:59:38 manager su: PAM (su) no module name supplied
Aug 11 16:59:38 manager su: PAM (su) illegal module type: i
Aug 11 16:59:38 manager su: PAM (su) no control flag supplied
Aug 11 16:59:38 manager su: PAM (su) no module name supplied

billyzhou033

su文件没问题

1. #%PAM-1.0
   
2. auth            sufficient      pam_rootok.so
   
3. # Uncomment the following line to implicitly trust users in the "wheel" group.
   
4. #auth           sufficient      pam_wheel.so trust use_uid
   
5. # Uncomment the following line to require a user to be in the "wheel" group.
   
6. #auth           required        pam_wheel.so use_uid
   
7. auth            include         system-auth
   
8. account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
   
9. account         include         system-auth
   
10. password        include         system-auth
    
11. session         include         system-auth
    
12. session         optional        pam_xauth.so

复制代码

haohaodeshijie

那是什么问题啊，哥们回复 2# billyzhou033


   

su8610

回复 3# haohaodeshijie


    是不是改动了验证库的路径 ？看看需要的库在不在

silencewangit

这个是因为pam的验证库文件错误导致。
检查下/etc/pam.d目录下的，login, comm-session, sshd等文件，把这几个文件中新添加的都还原回去。然后，重新登录或者su -切换。

可以的话，把你的这几个文件贴出来。

pxczy

顶楼上，看结果