PAM_CONV not working for SSH logins

Question

I have a problem implementing PAM_CONV for SSH logins on Solaris 9 with the latest OS patches. I am using my own PAM module.
I am trying to utilize PAM_CONV from pam_sm_acct_mgmt.
I am using the following definition in /etc/pam.conf :
other account optional pam_gabi.so
Here is how I use PAM_CONV from pam_sm_acct_mgmt :
#include <security/pam_appl.h>
#include <security/pam_modules.h>
#include <syslog.h>
void gabi_pam_free_msg (int num_msg,
struct pam_message **msg);
void gabi_pam_free_resp (int num_msg, struct pam_response *resp);
int gabi_pam_conv (int (*conv_funp)(), int num_msg,
char **messages,
struct pam_response **resp);
#define PAM_MSG(pamh, number, string)\
(char *) __pam_get_i18n_msg(pamh, "pam_unix", 3, number,
string)
void gabi_pam_free_msg (int num_msg, struct pam_message *msg)
if (msg && num_msg > 0) {
while (num_msg--) {
if (msg[num_msg].msg)
free((void*)msg[num_msg].msg);
free(msg);
void gabi_pam_free_resp (int num_msg, struct pam_response *resp)
int i;
struct pam_response *r;
for (i = 0, r = resp; i < num_msg && r; i++, r++) {
if (r->resp) {
free(r->resp);
if (resp)
free(resp);
extern
int pam_sm_acct_mgmt (pam_handle_t *pamh,
int flags,
int argc ,
const char **argv)
char message[PAM_MAX_NUM_MSG][PAM_MAX_MSG_SIZE];
char *pmessage = &message[0];
struct pam_response *ret_resp;
struct pam_conv *pam_convp;
int rv=0;
syslog(LOG_WARNING, "pam_sm_acct_mgmt");
memset(&message[0],0x00,PAM_MAX_MSG_SIZE);
if (pam_get_item(pamh, PAM_CONV, (void*)&pam_convp) == PAM_SUCCESS) {
syslog(LOG_WARNING, "pam_sm_acct_mgmt: PAM_CONV
== PAM_SUCCESS");
(void) snprintf(message[0],sizeof (message[0]),
(const char *) PAM_MSG(pamh,
1,"pam_sm_acct_mgmt : "));
rv=gabi_pam_conv(pam_convp->conv, 1, &pmessage,
&ret_resp);
syslog(LOG_WARNING, "pam_sm_acct_mgmt:seos_pam_conv
returned rv=%d",rv);
else
syslog(LOG_WARNING, "pam_sm_acct_mgmt: PAM_CONV !
= PAM_SUCCESS");
return PAM_IGNORE;
int gabi_pam_conv (int (*conv_funp)(), int num_msg, char **messages,
struct pam_response **resp)
struct pam_message *msg;
int retcode, i;
struct pam_response *ret_resp = NULL;
msg = (struct pam_message *)calloc(num_msg, sizeof(struct
pam_message));
if (msg == NULL)
return PAM_BUF_ERR;
for (i = 0; i < num_msg; i++) {
char nl = 0;
msg.msg = (char *)malloc(PAM_MAX_MSG_SIZE);
if (resp && (i == num_msg - 1)) {
msg[i].msg_style = PAM_PROMPT_ECHO_OFF;
ret_resp = *resp;
nl = '\0';
else
msg[i].msg_style = PAM_TEXT_INFO;
snprintf(msg[i].msg, PAM_MAX_MSG_SIZE, "%s%c",
messages[i], nl);
retcode = conv_funp(num_msg, &msg, &ret_resp, NULL);
syslog(LOG_WARNING, "seos_pam_conv: conv_funp returned
retcode=PAM_SUCCESS=%c",
((retcode == PAM_SUCCESS) ? 'Y' : 'N'));
gabi_pam_free_msg(num_msg, msg);
if (resp)
*resp = ret_resp;
else
gabi_pam_free_resp(num_msg, ret_resp);
return retcode;
I compile the source file like :
cc -K pic -I. -c -o <obj_file> <src_file>
cc -o pam_gabi.so -G -h pam_sample.so.1 -z text -z defs
-Bsymbolic <obj_file> -lc -lpam -lnsl
I copied pam_gabi.so to /usr/lib/security.
From a remote machine I run :
ssh -l <user_id> my_machine (<user_id> is a regular user)
I expect to get prompted with "pam_sm_acct_mgmt :" after I put in the
user password but I never see it and I am logged in successfully.
If I try :
rlogin -l <user_id> my_machine
I do get the "pam_sm_acct_mgmt :" prompt after providing the user's
password and login successfully.
The syslog messages show that 'conv_funp' in gabi_pam_conv
returned PAM_CONV_ERROR when called for the SSH login and
returned PAM_SUCCESS when called for the rlogin.
Kerberos is NOT installed on my Solaris 9 system.
Can anyone please explain this behavior ?
Thanks,
Gabi

Answer 1

After reading a little about this it looks like you have users enter user exec mode by default and after typing "enable" then entering the TACACS+ password you probably get denied.  If this is the case you are kind of left to your own devices.  I'll provide you some information and let you determine the best course.
R1(config-line#) privilege level [0-15] 
This line sets the privilege level of users that are logging in via SSH or other teleterminal services.
Here is an excerpt from the documentation for tac_plus provided at http://www.shrubbery.net/tac_plus/
CONFIGURING ENABLE PASSWORDS
The default privilege level for an ordinary user on the NAS is usually
1. When a user enables, she can reset this level to a value between 0
and 15 by using the NAS "enable" command. If she doesn't specify a
level, the default level she enables to is 15.
You can enable via tacacs+ e.g. by configuring on the NAS:
        aaa authentication enable default tacacs+
then whenever you attempt to enable, an authentication request is sent
with the special username $enab<n>$ where <n> is the privilege level
you are attempting to enable to.
(Note: in order to be compatible with earlier versions of tacacs, when
the requested enable level is 15, the daemon will also try the
username $enable$ before trying username $enab15$).
For example, with the above declaration, in order to enable on the
NAS, you need a user declaration like this one, on the daemon:
user = $enab15$ {
    login = cleartext "the enable password for level 15"
Note: Be aware that this does have the side effect that you now have a
user named $enab15$ who can then login to your NAS if she knows the
enable password.
Here is a similar declaration allowing users to enable to level 4:
user = $enab4$ {
    login = des bsoF4OivQCY8Q