[Samba] Password failure with xscreensaver when using winbind

Rowland penny rpenny at samba.org
Tue Jun 4 15:43:37 UTC 2019

On 04/06/2019 15:53, admins aixtema wrote:
> this one?
Yes ;-)
> auth        required      pam_env.so
> auth        sufficient    pam_winbind.so krb5_auth krb5_ccache_type=FILE
> auth        sufficient    pam_unix.so likeauth nullok try_first_pass
> auth        sufficient    pam_winbind.so use_first_pass
> auth        required      pam_deny.so
> account     sufficient    pam_winbind.so
> account     required      pam_unix.so
I use Devuan and I also have /etc/pam.d/xscreensaver which contains:

# /etc/pam.d/xscreensaver - PAM behavior for xscreensaver

@include common-auth
@include common-account

Which gives me lines similar to yours:

auth    [success=2 default=ignore]    pam_unix.so nullok_secure 
auth    [success=1 default=ignore]    pam_winbind.so krb5_auth 
krb5_ccache_type=FILE cached_login try_first_pass
auth    requisite            pam_deny.so
auth    required            pam_permit.so
auth    optional            pam_cap.so

account    [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
account    [success=1 new_authtok_reqd=done default=ignore] pam_winbind.so
account    requisite            pam_deny.so
account    required            pam_permit.so

The big difference is that there is only one 'pam_winbind' line in 
'auth', you have two

Can I suggest you ask your question on a Gentoo list, I know what I 
would try, but it would be better to get help from a Gentoo PAM expert.


More information about the samba mailing list