On Fri, 2009-06-05 at 11:09 -0400, Stephen Smalley wrote:
On Fri, 2009-06-05 at 08:09 -0700, Vadym Chepkov wrote:
> --- On Fri, 6/5/09, Stephen Smalley <sds(a)tycho.nsa.gov> wrote:
>
> > Found this thread:
> >
http://www.mail-archive.com/samba@lists.samba.org/msg15640.html
> >
> > Can you configure winbind with use default domain=yes?
> >
>
> I do have have such setup. Both type of users are affected: local and
"winbind"
Can you append "debug" to the arguments to the latter instance of
pam_selinux.so, e.g.:
session required pam_selinux.so open env_params debug
And then login again via ssh and look in /var/log/secure?
Hmmm...btw, I notice that order of entries has changed in /etc/pam.d in
F11 from F10, with the:
session include system-auth
line at the end of /etc/pam.d/sshd rather than between the two
pam_selinux instances.
So maybe the problem is that when you upgraded, it didn't replace your
pam config due to your local configuration of winbind, and thus you
didn't get that ordering change.
I know that they reworked the way sshd interacts with pam_selinux.
--
Stephen Smalley
National Security Agency