Pam_exec.so PAM module does not export variable PAM_USER as stated in the documentation

authenticationpamshell-scriptingunix

I'm trying to use the pam_exec.so PAM module to execute a script which needs to know the username/password coming from the application (OpenVPN in this case).

I have a script that executes printenv >>afile, but I don't see all the environment variables that the man pages states that pam_exec.so exports (namely PAM_USER I think), I only see the following:

PAM_SERVICE=openvpn
PAM_TYPE=auth
PWD=/usr/local/openvpn/bin
SHLVL=1
A__z="*SHLVL

I do successfully pick up the password off of STDIN and output it with this same script. But for the life of me I can't get the username.

Any thoughts on what I should try next?

Best Answer

If you set key-value pairs with the plugin "openvpn-plugin-auth-pam.so" like this:

plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so "openvpn mykey myval login COMMONNAME"

then it doesn't set PAM_USER (because it calls pam_start with user=NULL), maybe that's your problem?

Related Solutions

Linux – How is the cgroup pam module configured

The settings for the module are controlled by /etc/cgrules.conf just as for the rest of the cgroup facilities. When added to the PAM stack for a particular program, the program will inherit the cgroup as appropriate for its UID/GID.

If you add the pam_cgroup module to the login stack, the user's process will all automatically belong to the user's cgroup when they log in.

The details of this are actually documented in the README file for libcg. Here's a direct link to the README in the git repo.

Linux – PAM: How to create a service which passes username/password to a script

The full answer to this question is posted here:

https://forums.openvpn.net/post13002.html#p13002

Basically the example in the PAM module documentation for openvpn leads you astray here, it uses:

plugin openvpn-auth-pam.so "login login USERNAME password PASSWORD"

But the correct configuration for openvpn's server.config is:

plugin /usr/local/openvpn/sbin/openvpn-auth-pam.so "openvpn"

If you include the extra parameters shown in the documentation example it will never write out PAM_USER to the environment variables as is expected based on the documentation of pam_exec.so.

Best Answer

Related Solutions

Linux – How is the cgroup pam module configured

Linux – PAM: How to create a service which passes username/password to a script

Related Topic