VMware

This Question is Answered

1 "helpful" answer available (6 pts)
9 Replies Last post: Apr 24, 2009 12:14 PM by wamatha  

Service Console accounts/PAM authentication posted: Jun 6, 2007 2:32 PM

Click to view esiebert7625's profile Guru 6,794 posts since
Oct 23, 2006
I'm setting up PAM authentication on one of our servers, when I go to do the useradd in the Service Console I get the error message "invalid user name". Our AD user accounts are all numbers, ie. 123456, my guess is Linux does not allow this. Is there any other way to map a user account from Linux to AD for PAM to work?
Click to view Texiwill's profile Guru 10,213 posts since
Jan 13, 2004
Hello,

You are correct, useradd does not like accounts that start with numbers, however it is possible to use them once they are in the system. What steps are you using to integrate AD and ESX together?

Did you use:

esxcfg-auth --enablead --addomain=DOMAIN --addc=CONTROLLER

If you just do the above then that is only part of the full answer.

Where do the users home directories live? Are ACLs involved? Have you added the host as a Domain client, etc.? In general, for any remote authentication scheme, Linux often have to exist, there are ways around that as well.

Best regards,
Edward

Re: Service Console accounts/PAM authentication

4. Jun 11, 2007 8:02 AM in response to: esiebert7625
Click to view Texiwill's profile Guru 10,213 posts since
Jan 13, 2004
Hello,

Well, that is not how I integrate AD and Linux together. The esxcfg-auth is just the first step I find. You can actually setup a different way to integrate that does not require 'local' accounts and I think that is what you really want. Yes? In that case you also need samba and a few other configuration settings.

I have a recipe well documented for Fedroa Core, SLES, and RHEL3/4/5, but not yet for ESX. I will play with it some and tweak it for ESX. If you want the recipe please email me privately at elh at astroarch dot com. As I rather not post something that is not ESX specific here. It is on my short list to tweak anyways for a different project.

Best regards,
Edward

Re: Service Console accounts/PAM authentication

5. Jun 11, 2007 8:28 AM in response to: Texiwill
Click to view doubleH's profile Expert 531 posts since
Dec 23, 2006
there was a good presentation from vmworld 2006 i believe. i'm having trouble locating it, but will post the link when i find it.

Re: Service Console accounts/PAM authentication

7. Jun 11, 2007 4:06 PM in response to: esiebert7625
Click to view Texiwill's profile Guru 10,213 posts since
Jan 13, 2004
Hello,

Great presentation, that is exactly what I do when I integrate Linux (Service Console) and AD. Do note that the pam_access module is very important otherwise everyone will have access to the ESX Service Console.

If you do not pre-create home directories and do not use pam_mkhomedir then the user will be placed in "/" with no permissions to access anything except /tmp or anything else that is world-writable.

Unfortunatley, esxcfg-auth just does not do all this.

Best regards,
Edward

Re: Service Console accounts/PAM authentication

8. Jun 26, 2007 7:20 AM in response to: esiebert7625
Click to view sbeaver's profile Guru 7,719 posts since
Nov 1, 2004
Eric,

If you are connecting to AD then do not specify a specific DC or Server. Just specify the domain

o esxcfg-auth -–enablead -–addomain=addomain.com -–addc=addomain.com -–krb5realm=addomain.com –-krb5kdc= addomain.com –-krb5adminserver=addomain.com

DNS will point the ESX server to the correct place

Re: Service Console accounts/PAM authentication

9. Apr 24, 2009 12:14 PM in response to: sbeaver
Click to view wamatha's profile Enthusiast 38 posts since
Jul 29, 2008

I tried this but still the same problem

Apr 24 11:28:51 esx sshd14899: pam_krb5: authenticate error: ASN.1 encoding ended unexpectedly (1859794437)
Apr 24 11:28:51 esx sshd14899: pam_krb5: authentication fails for `xxx'

I have 25 servers that am getting the same error

VMware Developer

SDKs, APIs, Videos, Learn and much more in the Developer community.

Learn More

Developer Sample Code

Increase your developer productivity with VMware API sample code.

Learn More

VMworld Sessions & Labs

Online access to the latest VMworld Sessions & Labs and online services.

Learn more

Purchase PSO Credits Online

Purchase credits to redeem training and consulting services online.

Buy Now

Community Hardware Software

View reported configurations or report your own.

Learn More

VMware vSphere

Come witness the next giant leap in virtualization.

Register Today

Communities