Bareos LDAP-Authetification on Bareos WebUI & bconsole

[stefan....@harnet.de]

Hello,

i'm using Bareos version 22.1.1 and trying to set up authentication via LDAP. I'm trying to log in with the LDAP user "stefan.harbich". Unfortunately without success. Here are my configuration changes:
...

root@dsme01:~# cat /etc/pam.d/bareos
auth       required     pam_unix.so
## auth       required     pam_sss.so
account    required     pam_unix.so
account    required     pam_permit.so

...

root@dsme01:~# cat /etc/bareos/bconsole.conf

#
# Bareos User Agent (or Console) Configuration File
#
Director {
  Name = bareos-dir
##   address = localhost
  address = bareos.intern.example.com
  Password = "gYl8UCe/4EnxFfsBdW5dzzWads+#############+###"
  Description = "Bareos Console credentials for local Director"
}

...

root@dsme01:~# cat /etc/bareos/bareos-dir.d/console/pam-console.conf
Console {
  Name = "bareos-dir"
  Password = "gYl8UCe/4EnxFfsBdW5dzzWads+#############+###"
  UsePamAuthentication = yes
}

...

root@dsme01:~# cat /etc/bareos/bareos-dir.d/user/stefan.harbich.conf
User {
   Name = "stefan.harbich"
   CommandACL = status, .status
   JobACL = *all*
}

...

I added the user bareos to the root group.
Do you have any tips for me on what else I can check?

Greetings from Stefan Harbich

[Jörg Steffens]

On 29.07.23 at 12:15 wrote stefan....@harnet.de:

Have you seen the hints from
https://github.com/bareos/bareos/tree/master/contrib/misc/bareos_pam_integration
?
It explains how to test the PAM configuration only be using pamtester as
user bareos, instead of using the Bareos daemons.

Regards,
Jörg

--
Jörg Steffens joerg.s...@bareos.com
Bareos GmbH & Co. KG Phone: +49 221 630693-0
https://www.bareos.com Fax: +49 221 630693-10

Sitz der Gesellschaft: Köln | Amtsgericht Köln: HRA 29646
Komplementär: Bareos Verwaltungs-GmbH
Geschäftsführer: Stephan Dühr, Jörg Steffens, Philipp Storz

[Jörg Steffens]

As a collegue just pointed out, at least in bareos-21, there had been a
bug/crash when used without (empty) credentials, see
https://bugs.bareos.org/view.php?id=1446

Regards,
Jörg
--
Jörg Steffens joerg.s...@bareos.com

Bareos GmbH & Co. KG Phone: +49 221 630693-91

[Andreas Rogge]

Am 29.07.23 um 12:15 schrieb stefan....@harnet.de:

> root@dsme01:~# cat /etc/pam.d/bareos
> auth       required     pam_unix.so
> ## auth       required     pam_sss.so
> account    required     pam_unix.so
> account    required     pam_permit.so
> ...

pam_unix.so will usually require read access to /etc/shadow, you
mentioned that you added bareos to the "root" group. However, on
Fedora/RHEL this doesn't seem to do a thing and on Debian the required
group is called "shadow" instead.

Long story short: make sure the bareos director can read /etc/shadow or
- if you want LDAP - don't try setting up pam_unix first, because it
usually requires root privileges in the process calling PAM.

Best Regards,
Andreas

--
Andreas Rogge andrea...@bareos.com
Bareos GmbH & Co. KG Phone: +49 221-630693-86
http://www.bareos.com