Mengapa pam_mount meminta kata sandi?

Saya menggunakan pam-auth-updatealat ini untuk mengaktifkan beberapa profil konfigurasi pam:

 PAM configuration 
 PAM profiles to enable:
    [*] encfs encrypted home directories           
    [*] Unix authentication                             
    [*] Mount volumes for user                         
    [*] GNOME Keyring Daemon - Login keyring management  
    [*] ConsoleKit Session Management

Semua fitur berfungsi seperti yang diharapkan, tetapi ada satu hal - Mount volumes for useropsi tersebut tampaknya memengaruhi superintah.

Saya menambahkan baris berikut ke /etc/security/pam_mount.conf.xmlfile:

<volume user="morfik" fstype="fuse" path="encfs#/media/Server/Dropbox.encfs/Dropbox/encrypted" mountpoint="/media/Server/Dropbox" />

dan ketika saya mengetik terminal su morfik(sebagai root), seharusnya tidak ada prompt kata sandi, tetapi saya melihat ini:

# su morfik
reenter password for pam_mount:

Jika saya menghapus centang pada Mount volumes for useropsi di menu di atas, semuanya tampak seperti file dan reenter passwordmenghilang. Saya mencoba bermain dengan /etc/pam.d/file, tetapi saya tidak punya pengalaman dengan PAM, dan saya tidak bisa membuatnya bekerja.

Adakah yang tahu apa yang harus diubah dalam file-file ini?

PEMBARUAN # 1

Ini adalah isi /etc/pam.ddirektori:

# ls -al /etc/pam.d/
total 104K
drwxr-xr-x   2 root root 4.0K Mar 21 16:21 ./
drwxr-xr-x 153 root root  12K Mar 21 16:11 ../
-rw-r--r--   1 root root  197 Sep  8  2013 atd
-rw-r--r--   1 root root  384 May 25  2012 chfn
-rw-r--r--   1 root root   92 May 25  2012 chpasswd
-rw-r--r--   1 root root  581 May 25  2012 chsh
-rw-r--r--   1 root root 1.2K Mar 20 17:35 common-account
-rw-r--r--   1 root root 1.3K Mar 20 17:35 common-auth
-rw-r--r--   1 root root 1.5K Mar 20 17:35 common-password
-rw-r--r--   1 root root 1.3K Mar 20 17:35 common-session
-rw-r--r--   1 root root 1.2K Mar 20 17:35 common-session-noninteractive
-rw-r--r--   1 root root  527 Jul  3  2012 cron
-rw-r--r--   1 root root   69 Jul 16  2013 cups-daemon
-rw-r--r--   1 root root 4.8K Mar  5 10:18 login
-rw-r--r--   1 root root   92 May 25  2012 newusers
-rw-r--r--   1 root root  520 Jul 22  2008 other
-rw-r--r--   1 root root  147 Feb 13 07:15 passwd
-rw-r--r--   1 root root  255 Oct 15 18:40 polkit-1
-rw-r--r--   1 root root   84 Dec 27 12:40 samba
-rw-r--r--   1 root root 2.1K Feb 15 03:11 sshd
-rw-r--r--   1 root root 2.3K May 25  2012 su
-rw-r--r--   1 root root   95 Jan 15 22:58 sudo
-rw-r--r--   1 root root  108 Oct 19 23:42 xscreensaver

Tidak ada file /etc/pam.d/system-auth.

Saya memeriksa file apa yang ada pam_mountdi konten mereka, dan saya mendapatkannya:

# egrep -i pam_mount *
common-auth:auth        optional        pam_mount.so
common-session:session  optional        pam_mount.so

Isi file:

#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth    sufficient              pam_encfs.so 
auth    [success=1 default=ignore]  pam_unix.so nullok_secure try_first_pass
# here's the fallback if no module succeeds
auth    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional    pam_mount.so 
# end of pam-auth-update config

dan:

#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
session [default=1]         pam_permit.so
# here's the fallback if no module succeeds
session requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required    pam_unix.so 
session optional    pam_mount.so 
session optional            pam_ck_connector.so nox11
# end of pam-auth-update config

PEMBARUAN # 2

Saya menggunakan pengujian Debian. Saya mencoba mengubah posisi pam_mount, tetapi selalu sama. Saya telah membaca beberapa bagian dari manual ini, dan ada sesuatu seperti:

 When "sufficient" is used in the second column, you must make sure that
   pam_mount is added before this entry. Otherwise pam_mount will not  get
   executed  should  a  previous  PAM module succeed. Also be aware of the
   "include" statements. These make PAM look into the specified  file.  If
   there is a "sufficient" statement, then the pam_mount entry must either
   be in the included file before the "sufficient" statement or before the
   "include" statement.

Saya bahkan menambahkan pam_mountke /etc/pam.d/sufile untuk memeriksa apakah ini ada bedanya, tetapi tidak masalah. Jika pam_mountjika pertama, seperti yang mereka katakan, alih-alih prompt kata sandi, saya mendapatkan pam_mount passwordprompt ketika saya masuk ke sistem saya, dan masih meminta kata sandi ketika saya mencobasu morfik

Berlari ke masalah yang sama.

Ternyata masalah diselesaikan dengan menambahkan disable_interactiveopsi di sebelah pam_mount.sodalam file konfigurasi ( /etc/pam.d/common-{auth,session}).

Muncul tepat setelah pam_mount.sodan opsi dipisahkan dengan spasi (dari sonama file dan antara masing-masing dua opsi).

Ketika pam_mount.sokode dieksekusi saat login, ia akan menerima kata sandi dari atas tumpukan dan menggunakan kata sandi itu untuk mendekripsi volume Anda.

Ketika Anda melakukan sudari sesi root, tidak ada kata sandi yang diperlukan dan karenanya pam_mount.sotidak akan mendapatkan kata sandi apa pun. Jadi, tanpa disable_interactiveopsi, ia akan mencoba mendapatkan kata sandi.

Untungnya, seperti yang Anda lihat dari https://sourceforge.net/p/pam-mount/pam-mount/ci/master/tree/src/pam_mount.c , baris 493, pam_mountakan mencoba melanjutkan meskipun tanpa kata sandi, yang bagus, karena kata sandi tidak diperlukan jika volume sudah dibuka dan dipasang.

Tebakan total tetapi lihat /etc/pam.d/*file Anda dan pastikan bahwa konfigurasi PAM yang terkait pam_mountdiatur sebagai berikut:

auth optional pam_mount.so
...
auth include system-auth use_first_pass
...
session optional pam_mount.so

Ini tampaknya didukung oleh pam_mount.confhalaman manual:

kutipan

Messages
   <msg-authpw>pam_mount password:</msg-authpw>
        When  pam_mount cannot obtain a password through PAM, or is 
        configured to not do so in the first place, and is configured to ask 
        for a password interactively as a replacement, this prompt  will be 
        shown.

   <msg-sessionpw>reenter...:</msg-sessionpw>
        In  case  the  'session' PAM block does not have the password (e.g. 
        on su from root to user), it will ask again. This prompt can also be 
        customized.

CATATAN: Urutan /etc/pam.d/*file konfigurasi juga dirujuk di sini dalam topik ArchLinux Wiki berjudul: Pam mount .

Referensi

• Mengapa saya harus memasukkan kembali kata sandi saya untuk pam_mount?
• pam mount - prompt kata sandi saya sekarang mengatakan pam_mount kata sandi: