#776594 libpam-modules: pam_access fails for localhost root access even though +:root:LOCAL is present in access.conf

Package:
libpam-modules
Source:
pam
Description:
Pluggable Authentication Modules for PAM
Submitter:
Florian König
Date:
2015-01-29 18:39:06 UTC
Severity:
normal
#776594#5
Date:
2015-01-29 18:37:42 UTC
From:
To:
Dear Maintainer,

Recently I tried to set up cupsd with its web interface http://localhost:631
and found I was unable to authenticate as root for administration, even though
the cupsd.conf was set up as suggested. Investigating the problem I found this
line in /var/log/auth.log

Jan 29 14:41:38 quantum cupsd: pam_access(cups:auth): access denied for user
`root' from `localhost'

My /etc/pam.d/cups:

@include common-auth
@include common-account
@include common-session

My /etc/pam.d/common-auth:

auth    [success=2 default=ignore]      pam_krb5.so minimum_uid=1000
auth    [success=1 default=ignore]      pam_unix.so nullok_secure
try_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so
auth    optional                        pam_group.so
auth    required                        pam_access.so

And my /etc/security/access.conf:

+ : root : LOCAL
+ : root : 128.176.202.0/24
+ : root : 192.168.1.0/24
+ : somegroupsnotrelatedtoroot : ALL
- : root : ALL

Supplying pam_access with the debug option and retrying to , auth.log told me:

Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): login_access: user=root,
from=localhost, file=/etc/security/access.conf
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): line 56: +  :  root  :
LOCAL
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): list_match: list= root ,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): user_match: tok=root,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): string_match: tok=root,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): user_match=1, "root"
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): list_match: list= LOCAL,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): from_match: tok=LOCAL,
item=localhost
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): string_match: tok=LOCAL,
item=localhost
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): from_match=0, "localhost"
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): line 60: +  :  root  :
128.176.202.0/24
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): list_match: list= root ,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): user_match: tok=root,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): string_match: tok=root,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): user_match=1, "root"
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): list_match: list=
128.176.202.0/24, item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): from_match:
tok=128.176.202.0/24, item=localhost
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): string_match:
tok=128.176.202.0/24, item=localhost
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): network_netmask_match:
tok=128.176.202.0/24, item=localhost
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): from_match=0, "localhost"
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): line 61: +  :  root  :
192.168.1.0/24
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): list_match: list= root ,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): user_match: tok=root,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): string_match: tok=root,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): user_match=1, "root"
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): list_match: list=
192.168.1.0/24, item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): from_match:
tok=192.168.1.0/24, item=localhost
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): string_match:
tok=192.168.1.0/24, item=localhost
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): network_netmask_match:
tok=192.168.1.0/24, item=localhost
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): from_match=0, "localhost"
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): line 64: -  :  root  :
ALL
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): list_match: list= root ,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): user_match: tok=root,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): string_match: tok=root,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): user_match=1, "root"
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): list_match: list= ALL,
item=root
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): from_match: tok=ALL,
item=localhost
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): string_match: tok=ALL,
item=localhost
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): from_match=2, "localhost"
Jan 29 16:07:26 quantum cupsd: pam_access(cups:auth): access denied for user
`root' from `localhost'

Which, I believe, tells me that localhost is not accepted as an origin for
root. I may misunderstand the man-page but I think, since I was not accessing
from a remote host, that PAM_RHOST should not be set and thus LOCAL should
allow for localhost.

I solved my problem by including  "+ : root : LOCAL localhost" in access.conf;
now I was able to configure CUPS using its web interface as root. But I believe
this should not be necessary.

Cheers,
Florian König