pam_krb5 leaks into every PAM stack on mail and nb #273

New issue

Closed

opened 2026-08-07 16:12:05 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-08-07 16:12:05 +02:00

Owner

security.pam.krb5.enable defaults to security.krb5.enable. #271 spotted this on web-arm and set it false there, but hosts/mail/modules/kerberos.nix:24 (#267) and hosts/nb/modules/ldap-login.nix:84 (#269) both enable the Kerberos client config without opting out, so pam_krb5 is now in every PAM stack on both hosts.

nb: an off-VPN login stalls while pam_krb5 tries to reach mail.cloonar.com:88 before falling through to pam_unix. It is also redundant — SSSD's auth_provider = krb5 already performs the Kerberos auth and places the ticket in KCM, whereas pam_krb5 would write a parallel FILE ccache.
mail: pam_krb5 sits in every PAM stack on the host holding the KDC and the directory, creating an auth path where a local account whose name matches a principal could authenticate with its Kerberos password.

Fix is security.pam.krb5.enable = false; in both modules.

`security.pam.krb5.enable` defaults to `security.krb5.enable`. #271 spotted this on `web-arm` and set it `false` there, but `hosts/mail/modules/kerberos.nix:24` (#267) and `hosts/nb/modules/ldap-login.nix:84` (#269) both enable the Kerberos client config without opting out, so pam_krb5 is now in every PAM stack on both hosts. - **`nb`:** an off-VPN login stalls while pam_krb5 tries to reach `mail.cloonar.com:88` before falling through to `pam_unix`. It is also redundant — SSSD's `auth_provider = krb5` already performs the Kerberos auth and places the ticket in KCM, whereas pam_krb5 would write a parallel FILE ccache. - **`mail`:** pam_krb5 sits in every PAM stack on the host holding the KDC and the directory, creating an auth path where a local account whose name matches a principal could authenticate with its Kerberos password. Fix is `security.pam.krb5.enable = false;` in both modules.

dominik.polakovics added the

bug

label

2026-08-07 16:12:05 +02:00

dominik.polakovics referenced this issue from a pull request that will close it,

2026-08-07 16:12:31 +02:00

fix(mail,nb): keep pam_krb5 out of the PAM stack #274

dominik.polakovics closed this issue

2026-08-07 16:15:31 +02:00