☰

允许多个用户在没有密码的情况下“su”到多个其他用户

tag-icon • tag-icon users su pam
允许多个用户在没有密码的情况下“su”到多个其他用户

这与这个问题类似：

允许 user1 无需密码即可“su - user2”

然而，该解决方案仅适用于多个用户访问“su”一个用户。

#works fine :) 2 or more users accessing 1 user
auth       [success=ignore default=1] pam_succeed_if.so user = user1
auth       sufficient   pam_succeed_if.so use_uid user = user2
auth       sufficient   pam_succeed_if.so use_uid user = user3

如果我尝试将 n 个用户转到 n 个用户：

#dont work :(
auth       [success=ignore default=1] pam_succeed_if.so user = user1
auth       sufficient   pam_succeed_if.so use_uid user = user2
auth       sufficient   pam_succeed_if.so use_uid user = user3

auth       [success=ignore default=1] pam_succeed_if.so user = user4
auth       sufficient   pam_succeed_if.so use_uid user = user2
auth       sufficient   pam_succeed_if.so use_uid user = user3

我收到 PAM 错误或要求输入密码。

答案1

据我了解，该代码[success=ignore default=1]意味着如果模块返回除成功以外的任何内容，则跳过 1 个模块。也许您需要跳过 2 步才能进入下一个pam_succeed_if？

答案2

您需要更改身份验证顺序，如下所示：

auth       [success=1 default=ignore] pam_succeed_if.so user = user1
auth       [success=ignore default=1] pam_succeed_if.so user = user4
auth       sufficient   pam_succeed_if.so use_uid user in user2:user3

答案3

pam_exec.so我正在使用而不是完成它pam_succeedif.so。

紧接着：/etc/pam.d/su​pam_rootok.so

auth  sufficient             pam_exec.so quiet /etc/pam.d/check_user.sh

在/etc/pam.d/check_user.sh：

#!/bin/bash
[[ -z $PAM_RUSER ]] && PAM_RUSER=$PAM_USER # under some circumstances pam_exec.so does not pass PAM_RUSER to the script
[[ "$PAM_TYPE" == "auth" ]] || exit 1
case "$PAM_RUSER" in
  user1)        USERS="user1 user2" ; ;;
  user3)        USERS="user3 user4" ; ;;
  *)            exit 1 ; ;;
esac
[[ "$USERS" =~ "$PAM_USER" ]]

相关内容