#5533 Webmin on Ubuntu using Active Directory
I have been using Webmin for a while on Ubuntu and getting user passwords from a Microsoft Active Directory. It used to work fine as far as I remember on Ubuntu 18 and some older version of Webmin.
Long time ago, I made it work using the following on the /etc/pam.d/webmin file:
'#%PAM-1.0 (' inserted intentionally, it is not in the actual file)
auth required pam_sss.so
account required pam_unix.so
password required pam_unix.so shadow nullok use_authtok
session required pam_unix.so
Original webmin file on /etc/pam.d never worked on Ubuntu.
Right now I am using Ubuntu 20.04 and the latest version of Webmin (1.983), when I change the /etc/pam.d/webmin file, the Webmin web authentication using Active Directory users and passwords starts working but after a while it gives an authentication error. The following is logged on /var/log/auth.log:
cxnginx webmin[301124]: Invalid login as tatodc@smartteg.com from 192.168.255.169
When I recreate the /etc/pam.d/webmin file and reboot the system everything works fine.
Does anything else get logged to any other log files, like /var/log/messages, when the login fails?
Also, are there any logs on the Active Directory server with more details?
Unfortunately, I don't find any other log regarding this matter. There is no /var/log/messages file.
I just installed a fresh copy of Ubuntu to start from scratch and reproduce the problem.
When Webmin installs, it creates /etc/pam.d/webmin with the following config:
'#%PAM-1.0 (' inserted intentionally, it is not in the actual file)
@include common-auth
@include common-account
@include common-password
@include common-session
With that config in place, I got the following in /var/log/auth.log :
Dec 12 23:07:03 cxwebsvr perl[595297]: pam_unix(webmin:auth): authentication failure; logname= uid=0 euid=0 tty=10000 ruser= rhost=192.168.255.169 user=tatodc@smartteg.com
Dec 12 23:07:03 cxwebsvr perl[595297]: pam_sss(webmin:auth): authentication success; logname= uid=0 euid=0 tty=10000 ruser= rhost=192.168.255.169 user=tatodc@smartteg.com
Dec 12 23:07:03 cxwebsvr perl[595297]: pam_sss(webmin:account): Access denied for user tatodc@smartteg.com: 6 (Permission denied)
Dec 12 23:07:03 cxwebsvr webmin[595297]: Invalid login as tatodc@smartteg.com from 192.168.255.169
To have it working, I mv webmin file to /etc/pam.d/webmin.old, go the the Webmin web interface, log in with a local user, go to System > PAM Authentication > Add a new PAM Service, type "webmin" as Service name, no description, and leave the default option at Initial PAM modules (Unix authentication)
Previous procedure creates /etc/pam.d/webmin file with the following config:
'#%PAM-1.0 (' inserted intentionally, it is not in the actual file)
auth required pam_pwdb.so shadow nullok
account required pam_pwdb.so
password required pam_pwdb.so shadow nullok use_authtok
session required pam_pwdb.so
Go to web log in again, try to use my Active Directory and got an "Log in failed. Please try again" message and the /var/log/auth.log file shows:
Dec 12 23:21:11 cxwebsvr perl[597015]: PAM unable to dlopen(pam_pwdb.so): /lib/security/pam_pwdb.so: cannot open shared object file: No such file or directory
Dec 12 23:21:11 cxwebsvr perl[597015]: PAM adding faulty module: pam_pwdb.so
Dec 12 23:21:11 cxwebsvr webmin[597015]: Invalid login as tatodc@smartteg.com from 192.168.255.169
Because of that, I change the /etc/pam.d/webmin file to:
auth required pam_sss.so
account required pam_unix.so
password required pam_unix.so shadow nullok use_authtok
session required pam_unix.so
Go to web log in again, and it works, I got logged in with my Active Directory account. /var/log/auth.log shows:
Dec 12 23:25:24 cxwebsvr perl[597016]: pam_sss(webmin:auth): authentication success; logname= uid=0 euid=0 tty=10000 ruser= rhost=192.168.255.169 user=tatodc@smartteg.com
Dec 12 23:25:24 cxwebsvr perl[597016]: pam_unix(webmin:session): session opened for user tatodc@smartteg.com by (uid=0)
Dec 12 23:25:25 cxwebsvr sudo: pam_unix(sudo:auth): authentication failure; logname= uid=990201103 euid=0 tty=/dev/pts/1 ruser=tatodc@smartteg.com rhost= user=tatodc@smartteg.com
Dec 12 23:25:27 cxwebsvr sudo: pam_sss(sudo:auth): authentication success; logname= uid=990201103 euid=0 tty=/dev/pts/1 ruser=tatodc@smartteg.com rhost= user=tatodc@smartteg.com
Dec 12 23:25:27 cxwebsvr sudo: tatodc@smartteg.com : TTY=pts/1 ; PWD=/usr/share/webmin ; USER=root ; COMMAND=list
Dec 12 23:25:27 cxwebsvr webmin[597016]: Successful login as tatodc@smartteg.com from 192.168.255.169
Now, it is just a matter of time for it to stop working. I'll post again when it happens.
Random checkup, refreshed Webmin, AD user was still logged in, did a log out, then tried to log in again but the problem appeared. Tried to do it one more time just in case I mistyped the password, same problem.
Here's what the auth.log file shows:
Dec 13 02:44:50 cxwebsvr webmin[605426]: Logout by tatodc@smartteg.com from 192.168.255.169
Dec 13 02:45:01 cxwebsvr webmin[605435]: Invalid login as tatodc@smartteg.com from 192.168.255.169
Dec 13 02:46:44 cxwebsvr webmin[605434]: Invalid login as tatodc@smartteg.com from 192.168.255.169
So odd that it just stops working after a while! Does running
/etc/webmin/restartmake it start working again?no, unfortunately, it doesn't
That is very odd.. were you able to capture any logs from the Active Directory server side that might help?
I'm not an AD expert, tried to do the best I can trying to be not as invasive as the AD is a production server.
Just tried a webmin login attempt and the AD logged "An account was successfully logged on."
Full log:
An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: SYSTEM
Account Name: DC0DC$
Account Domain: SMARTTEG.COM
Logon ID: 0x2C1E5A98
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {e3880126-b630-9b6d-00fe-f209391bcc70}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name: -
Source Network Address: 127.0.0.1
Source Port: 60753
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
After a while investigating in the issue, my domain user couldn't log into the Ubuntu server, logs on Ubuntu are:
Jan 1 00:35:30 cxwebsvr sshd[4386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.255.170 user=tatodc@smartteg.com
Jan 1 00:35:31 cxwebsvr sshd[4386]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.255.170 user=tatodc@smartteg.com
Authentication fails on pam_unix and succeeds on pam_sss, that's the correct behavior but there's no response after that, Putty kicks me out.
I installed a new system to check it out the correct behavior and the logs for the same procedure were:
Jan 1 03:43:01 webmin sshd[1921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.255.170 user=tatodc@smartteg.com
Jan 1 03:43:01 webmin sshd[1921]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.255.170 user=tatodc@smartteg.com
Jan 1 03:43:05 webmin sshd[1921]: Accepted password for tatodc@smartteg.com from 192.168.255.170 port 57931 ssh2
Jan 1 03:43:05 webmin sshd[1921]: pam_unix(sshd:session): session opened for user tatodc@smartteg.com by (uid=0)
Jan 1 03:43:05 webmin systemd-logind[815]: New session 4 of user tatodc@smartteg.com.
I'm gonna wait a while to see if there's a problem with the new server, if every thing works fine, I'll install webmin to see if the erratic behavior replicates.
So it records that same message even when Webmin says the login failed?
When going to the webmin web interface, the AD receives the request and authenticates it successfully as shown before. At the same time, auth.log shows: "cxnginx webmin[301124]: Invalid login as tatodc@smartteg.com from 192.168.255.169".
To get more details on what's failing, try this :
1 - Edit
/etc/webmin/miniserv.confand add the linedebuglog=/var/webmin/miniserv.debug2 - Run
/etc/webmin/restart3 - Attempt a login as a user that's failing, and check that gets written to
miniserv.debugwhen that happens. Best to do this when nobody else is using the system, as the debug information we need will be fixed up with other users.there you have it, debug log for 1 failed login attempt
So based on that debug log, it looks like Webmin is failing at the PAM validation step. Did you say above that other services like SSH also fail login at the same time Webmin does?
Hi Jamie, I left this case open waiting for the new version of Ubuntu, 22.04, to figure it out if there was something wrong with version 20.04, but the behavior looks the same.
Update environment is:
Ubuntu 22.04
Webmin 1.994
I'm attaching a new output of /var/webmin/miniserv.debug to resume where we left.
I also noticed that the the files /var/log/syslog and /var/log/sssd/sssd_nss.log record entries when the web login fails, here are the outputs.
/var/log/syslog :
Jun 11 21:50:42 nwsvr kernel: [ 2292.978996] audit: type=1400 audit(1655009442.821:630): apparmor="ALLOWED" operation="open" profile="/usr/sbin/sssd" name="/proc/2849/cmdline" pid=846 comm="sssd_nss" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Jun 11 21:50:42 nwsvr kernel: [ 2293.011836] audit: type=1400 audit(1655009442.853:631): apparmor="ALLOWED" operation="open" profile="/usr/sbin/sssd" name="/proc/2849/cmdline" pid=846 comm="sssd_nss" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
/var/log/sssd/sssd_nss.log
(2022-06-11 21:55:06): [nss] [nss_protocol_parse_name] (0x0020): [CID#38] An empty name was provided!
(2022-06-11 21:55:06): [nss] [nss_getby_name] (0x0020): [CID#38] Invalid request message!
(2022-06-11 21:55:06): [nss] [nss_protocol_parse_name] (0x0020): [CID#39] An empty name was provided!
(2022-06-11 21:55:06): [nss] [nss_getby_name] (0x0020): [CID#39] Invalid request message!
Can you confirm of Active Directory authentication works for other services, like FTP and SSH?
AD authentication works, I only SSH using my AD user, I also retrieved the miniserv.debug file using SCP with my AD user
This is a mystery, sorry ... I don't have a test environment in which I can reproduce this issue.
Hi,
I have the same behaviour. SSH login with AD authentication always work to the server. But the webaccess to webmin fails after a while.
I am using Ubuntu 22.04 and Webmin 2.010
I noticed though that if I follow the procedure above I get this if I restart webmin
[11/Jan/2023:01:10:11 +0100] PAM test failed - maybe /etc/pam.d/webmin does not exist
The file obviously is there...
To get it working again I do:
1) cp webmin.org webmin
2) restart webmin
Then I get:
[11/Jan/2023:01:12:10 +0100] PAM authentication enabled
3) Try to login to the webgui. It fails. (it actually seem important to try before doing next step?)
4) Edit the /etc/pam.d/webmin again with
auth required pam_sss.so
account required pam_unix.so
password required pam_unix.so shadow nullok use_authtok
session required pam_unix.so
5) Try to login to the webgui. It works!
But if I now restart webmin again I get this in the log again and of course the login fails again.
PAM test failed - maybe /etc/pam.d/webmin does not exist.
During testing I played around with the parameter:
Treat logins that only pass PAM validation as
Under:
Webmin --> Webmin Users --> Configure Unix User Authentication
I was hoping to be able to force all PAM authenticated users into a very limited user.
But doing changes on the "Unix User Authentication" page seemed to trigger the "unable to log in" issue but the procedure above got me back to be able to login again.
I wonder if it is related to this row:
auth required pam_sss.so
I commented out that one and then I can restart webmin.
I can also log in using my AD account.
I have not really used PAM before so feel free to come with suggestions what to try. :)
Last edit: Fredrik Jansson 2023-01-11
Hi,
I have a similar behavior running Ubuntu Server 22.04 and Webmin 2.013 with sssd AD-authentication but with the default Webmin PAM-settings I could not log on at all with AD accounts.
Following the procedure above got the same behavior as mentioned above - Login works but only until Webmin or the server is restarted.
Giving the error message: PAM test failed - maybe /etc/pam.d/webmin does not exist
Playing around with the settings in /etc/pam.d/webmin I found that as long as at least one of the default @include remain, Webmin seems to be happy and logins continue to work after Webmin or server restarts.
So I ended up with the following configuration:
@include common-auth
account required pam_unix.so
password required pam_unix.so shadow nullok use_authtok
session required pam_unix.so
Now AD-authentication works but still access is denied based on permissions. In my case I wanted all users that are members of the AD-group "LinuxAdmins" to be able to log in as root in Webmin.
I did that by setting the "Unix User Authentication", under Webmin --> Webmin Users --> Configure Unix User Authentication, to:
Allowed Unix Users: Allow Unix users listed below to login ..
Allow User or Group As Webmin user
Members of group.. linuxadmins root
Allow users who can run all commands via
sudo to login as root: True
Treat logins that only pass PAM validation as: False
Additional restrictions: Allow all Unix users
Deny Unix users whose shells are not in file: False
Note that the group name is LinuxAdmins in AD but during the login sssd present all group names in lower case, hence the group name to match is specified in lower case in Webmin configuration.
Anyway, just wanted to share my findings and workaround if anyone else is struggling to get this to work.
Thanks for a great tool!
:)
Last edit: Joakim Högström 2023-01-23