I recently upgraded to Leap 15.0 from 42.3 using the zypper-method. The upgrade finished without problem but after reboot I could not log in. This is the error message that is shown if I try a TTY login (graphical login gives no hint):
User unknown to the underlying authentication module
This happens for all users and root! I have tried rebooting several times with no success. There are two users defined: one locally authenticated and one network user authenticated via LDAP.
It happened now and then in Leap 42.3 the same thing with root so I could not use graphical Yast. The reason for this was that the order of the lines in one or more of the following files got screwed up:
/etc/pam.d/common-account -> common-account-pc
/etc/pam.d/common-auth -> common-auth-pc
/etc/pam.d/common-password -> common-password-pc
/etc/pam.d/common-session -> common-session-pc
/etc/pam.d/gdm-password -> gdm
Why this happened was never found out but more machines on the local network had the same issue. But as sudo never was compromised I could use that to fire up text-mode Yast and go into Network Services->LDAP and Kerberos Client, hit Change Settings and then OK on the following screen. The files were then rewritten with the lines in the correct order and all was fine. I thought that I had made backups of the correct files but no such luck. Below I show what they look like now (except comment lines) and I would like to know if there is anything wrong with the order of the lines and in that case what the correct order should be. I imagine that somehow LDAP requirement obscures local authentication but unfortunately that doesn’t help me.
cat /etc/pam.d/common-account-pc
...
account requisite pam_unix.so try_first_pass
account required pam_krb5.so use_first_pass
account sufficient pam_localuser.so
account required pam_ldap.so use_first_pass
cat /etc/pam.d/common-auth-pc
...
auth required pam_env.so
auth optional pam_gnome_keyring.so
auth sufficient pam_unix.so try_first_pass
auth sufficient pam_krb5.so use_first_pass
auth required pam_ldap.so use_first_pass
cat /etc/pam.d/common-password-pc
...
password requisite pam_cracklib.so
password optional pam_gnome_keyring.so use_authtok
password [default=ignore success=1] pam_succeed_if.so uid > 999 quiet
password sufficient pam_unix.so use_authtok nullok shadow try_first_pass
password sufficient pam_krb5.so
password required pam_ldap.so try_first_pass use_authtok
cat /etc/pam.d/common-session-pc
...
session optional pam_mkhomedir.so
session optional pam_systemd.so
session required pam_limits.so
session required pam_unix.so try_first_pass
session optional pam_krb5.so
session optional pam_ldap.so
session optional pam_umask.so
session optional pam_gnome_keyring.so auto_start only_if=gdm,gdm-password,lxdm,lightdm
session optional pam_env.so
cat /etc/pam.d/gdm
...
auth requisite pam_nologin.so
auth include common-auth
account include common-account
password include common-password
session required pam_loginuid.so
session optional pam_keyinit.so force revoke
session include common-session
If the line order has indeed been screwed up there is hope if someone can tell me the right order. Thanks beforehand for any help that you may provide.
Cheers,
gostal
I edited the /etc/pam.d-files like so (comment lines omitted):