Hi,<br><br>Here are some old notes I made when I set up PAM with freenx<br><a href="http://gatopelao.org/cmsimple/?desktop_image:pam_script">http://gatopelao.org/cmsimple/?desktop_image:pam_script</a><br><br>There's an example of the stack in /etc/pam.d/ssh but you'll probably have to play around with it to get it going.<br>
<br>In the example it mounts samba shares in pam_script_ses_open, but once you've got the stack working, you can put anything in there.<span style="font-weight: bold;"></span><br><br>Hope this helps,<br>Chris.<br><br>
<br><div class="gmail_quote">On Thu, Jan 27, 2011 at 9:01 PM, <span dir="ltr"><<a href="mailto:chris@ccburton.com">chris@ccburton.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br><tt><font size="2">Alex Aminoff <<a href="mailto:aminoff@nber.org" target="_blank">aminoff@nber.org</a>> wrote on 27/01/2011
16:54:33:<div class="im"><br>
> Hi folks. We are trying to get NX to work with a non-standard setup.
To <br>
</div></font></tt>
<br><tt><font size="2">'lo</font></tt>
<br><div class="im">
<br><tt><font size="2">> log in the user, ssh is calling PAM, which calls
a module that rings the<br>
> user's phone and waits for a given key to be pressed. We would also<br>
> like to be able to use otpw as an alternative second factor for <br>
> authentication.<br>
> <br>
> The problem we are getting seems to be that the user's password is
not <br>
> sent because PAM is doing something other than expected. The following
is <br>
> from nxserver.log with loglevel 6:<br>
> <br>
> HELLO NXSERVER - Version 3.2.0-74-SVN OS (GPL, using backend: 3.3.0)<br>
> NX> 105 hello NXCLIENT - Version 3.2.0<br>
> NX> 134 Accepted protocol: 3.2.0<br>
> NX> 105 SET SHELL_MODE SHELL<br>
> NX> 105 SET AUTH_MODE PASSWORD<br>
> NX> 105 login<br>
> NX> 101 User: aminoff<br>
> NX> 102 Password:<br>
> Info: Auth method: ssh This server requires two-factor authentication.
<br>
> Enter your unix password, then either use otpw or phone authentication.
<br>
> Press</font></tt>
<br>
<br></div><tt><font size="2">It stops here on "Press" because you have
a # in pam.d/ssh which</font></tt>
<br><tt><font size="2">comments out the rest of the line.</font></tt>
<br>
<br><tt><font size="2">Change it to \#</font></tt>
<br><div class="im"><tt><font size="2"><br>
> Password:<br>
> Info: Closing connection to slave with pid 7902.<br>
> <br>
> NX> 404 ERROR: wrong password or login<br>
</font></tt>
<br></div><tt><font size="2">Have you chacked if the account and password are OK
???</font></tt>
<br><div class="im">
<br><tt><font size="2">> NX> 999 Bye<br>
> <br>
> Uncommented lines in our node.conf:<br>
> <br>
> ENABLE_SLAVE_MODE="1"<br>
> NX_LOG_LEVEL=6<br>
> NX_LOG_SECURE=0<br>
> NX_LOGFILE=/var/log/nxserver.log<br>
> <br>
> We realize that OTPW will be a problem because then we would need
an <br>
> additional prompt on the client side, so for testing we are using
an <br>
> account that does not have OTPW set up: pam_otpw just silently fails.<br>
> <br>
> Here is an excerpt from our pam.d/sshd:<br>
> <br>
> #%PAM-1.0<br>
> auth required pam_sepermit.so<br>
> auth required pam_env.so<br>
> auth optional pam_echo.so This
server requires two-factor <br>
> authentication. Enter your unix password, then either use otpw or
phone <br>
> authentication. Press # on your phone when you hear the ding.<br>
</font></tt>
<br></div><tt><font size="2">Here's the bit you need to \# with. The users still
won't see it in the</font></tt>
<br><tt><font size="2">NX client though.</font></tt>
<br><div class="im">
<br><tt><font size="2">> auth requisite pam_succeed_if.so
uid >= 500 quiet<br>
> auth requisite pam_ldap.so try_first_pass
debug<br>
> auth sufficient pam_otpw.so debug<br>
> auth sufficient pam_exec.so debug log=/var/log/pam_phone.log
<br>
> /etc/cvslocal/perlscript/pam_phone<br>
> auth required pam_deny.so<br>
> <br>
> Basically, my question is, can NX be made to support any arbitrary
<br>
> communications/prompts that ssh sends? If it does not do so now, we
would <br>
</font></tt>
<br></div><tt><font size="2">The logging in of the user to FreeNX is done with
an "expect" script which</font></tt>
<br><tt><font size="2">you can test yourself,</font></tt>
<br>
<br><tt><font size="2">eg run:-</font></tt>
<br>
<br><tt><font size="2"> /usr/bin/nxnode-login ssh aminoff
22 /usr/bin/nxnode --check</font></tt>
<br>
<br><tt><font size="2">The script waits with NO prompt for you to enter your
password.</font></tt>
<br>
<br>
<br><tt><font size="2">The expect script "while {1}s"
around a loop until it sees a string</font></tt>
<br><tt><font size="2"> which matches for a fail or a success, so your
string shouldn't</font></tt>
<br><tt><font size="2">cause it any problems.</font></tt>
<br>
<br><tt><font size="2">My guess is something else is wrong, maybe the password</font></tt>
<br><tt><font size="2">maybe something else in pam.d</font></tt>
<br>
<br><tt><font size="2">If you try that we'll see.</font></tt>
<br><div class="im">
<br><tt><font size="2">> be willing to pay NoMachine a bit to have them
implement it. Does that <br>
> seem sensible?<br>
</font></tt>
<br></div><tt><font size="2">Not really. Nomachine don't have anything to do with
FreeNX.</font></tt>
<br>
<br><tt><font size="2">In fact nomachine seem to be a bit annoyed with the
proliferation of</font></tt>
<br><tt><font size="2">Open Source nxagent launchers, which seem to be getting
associated</font></tt>
<br><tt><font size="2">with them, so much so that the next version of the
nx libraries and</font></tt>
<br><tt><font size="2">Xserver (nxagent) won't be Open Source.</font></tt>
<br>
<br><tt><font size="2">I suspect X is on its way out now anyway though.</font></tt>
<br><tt><font size="2"> <br>
> - Alex Aminoff<br>
</font></tt><br>________________________________________________________________<br>
Were you helped on this list with your FreeNX problem?<br>
Then please write up the solution in the FreeNX Wiki/FAQ:<br>
<br>
<a href="http://openfacts2.berlios.de/wikien/index.php/BerliosProject:FreeNX_-_FAQ" target="_blank">http://openfacts2.berlios.de/wikien/index.php/BerliosProject:FreeNX_-_FAQ</a><br>
<br>
Don't forget to check the NX Knowledge Base:<br>
<a href="http://www.nomachine.com/kb/" target="_blank">http://www.nomachine.com/kb/</a><br>
<br>
________________________________________________________________<br>
FreeNX-kNX mailing list --- <a href="mailto:FreeNX-kNX@kde.org">FreeNX-kNX@kde.org</a><br>
<a href="https://mail.kde.org/mailman/listinfo/freenx-knx" target="_blank">https://mail.kde.org/mailman/listinfo/freenx-knx</a><br>
________________________________________________________________<br></blockquote></div><br>