История изменений
Исправление aido, (текущая версия) :
bash есть в /etc/shells ?
Есть.
strace сказал нечто вот такое:
sendto(4, "p\0\0\0Q\4\5\0\4\0\0\0\0\0\0\0op=PAM:session_o"..., 112, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 112
ppoll([{fd=4, events=POLLIN}], 1, {0, 500000000}, NULL, 0) = 1 ([{fd=4, revents=POLLIN}], left {0, 499994125})
recvfrom(4, "$\0\0\0\2\0\0\0\4\0\0\0\321t\0\0\0\0\0\0p\0\0\0Q\4\5\0\4\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
recvfrom(4, "$\0\0\0\2\0\0\0\4\0\0\0\321t\0\0\0\0\0\0p\0\0\0Q\4\5\0\4\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
close(4) = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f79aa20d0) = 29906
rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], NULL, 8) = 0
rt_sigaction(SIGTERM, {0x555a54716c, [], 0}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [ALRM TERM], NULL, 8) = 0
wait4(-1, Cannot execute /bin/bash: Permission denied
проще всего посмотреть на /etc/pam.d/su
Какие аномалии искать?
root@Orangepi:~# cat /etc/pam.d/su
#
# The PAM configuration file for the Shadow `su' service
#
# This allows root to su without passwords (normal operation)
auth sufficient pam_rootok.so
# Uncomment this to force users to be a member of group root
# before they can use `su'. You can also add "group=foo"
# to the end of this line if you want to use a group other
# than the default "root" (but this may have side effect of
# denying "root" user, unless she's a member of "foo" or explicitly
# permitted earlier by e.g. "sufficient pam_rootok.so").
# (Replaces the `SU_WHEEL_ONLY' option from login.defs)
# auth required pam_wheel.so
# Uncomment this if you want wheel members to be able to
# su without a password.
# auth sufficient pam_wheel.so trust
# Uncomment this if you want members of a specific group to not
# be allowed to use su at all.
# auth required pam_wheel.so deny group=nosu
# Uncomment and edit /etc/security/time.conf if you need to set
# time restrainst on su usage.
# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
# as well as /etc/porttime)
# account requisite pam_time.so
# This module parses environment configuration file(s)
# and also allows you to use an extended config
# file /etc/security/pam_env.conf.
#
# parsing /etc/environment needs "readenv=1"
session required pam_env.so readenv=1
# locale variables are also kept into /etc/default/locale in etch
# reading this file *in addition to /etc/environment* does not hurt
session required pam_env.so readenv=1 envfile=/etc/default/locale
# Defines the MAIL environment variable
# However, userdel also needs MAIL_DIR and MAIL_FILE variables
# in /etc/login.defs to make sure that removing a user
# also removes the user's mail spool file.
# See comments in /etc/login.defs
#
# "nopen" stands to avoid reporting new mail when su'ing to another user
session optional pam_mail.so nopen
# Sets up user limits according to /etc/security/limits.conf
# (Replaces the use of /etc/limits in old login)
session required pam_limits.so
# The standard Unix authentication modules, used with
# NIS (man nsswitch) as well as normal /etc/passwd and
# /etc/shadow entries.
@include common-auth
@include common-account
@include common-session
Исправление aido, :
bash есть в /etc/shells ?
Есть.
strace сказал нечто вот такое:
sendto(4, "p\0\0\0Q\4\5\0\4\0\0\0\0\0\0\0op=PAM:session_o"..., 112, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 112
ppoll([{fd=4, events=POLLIN}], 1, {0, 500000000}, NULL, 0) = 1 ([{fd=4, revents=POLLIN}], left {0, 499994125})
recvfrom(4, "$\0\0\0\2\0\0\0\4\0\0\0\321t\0\0\0\0\0\0p\0\0\0Q\4\5\0\4\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
recvfrom(4, "$\0\0\0\2\0\0\0\4\0\0\0\321t\0\0\0\0\0\0p\0\0\0Q\4\5\0\4\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
close(4) = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f79aa20d0) = 29906
rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], NULL, 8) = 0
rt_sigaction(SIGTERM, {0x555a54716c, [], 0}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [ALRM TERM], NULL, 8) = 0
wait4(-1, Cannot execute /bin/bash: Permission denied
проще всего посмотреть на /etc/pam.d/su
Какие аномалии искать?
Исходная версия aido, :
bash есть в /etc/shells ?
Есть.
strace сказал нечто вот такое:
sendto(4, "p\0\0\0Q\4\5\0\4\0\0\0\0\0\0\0op=PAM:session_o"..., 112, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 112
ppoll([{fd=4, events=POLLIN}], 1, {0, 500000000}, NULL, 0) = 1 ([{fd=4, revents=POLLIN}], left {0, 499994125})
recvfrom(4, "$\0\0\0\2\0\0\0\4\0\0\0\321t\0\0\0\0\0\0p\0\0\0Q\4\5\0\4\0\0\0"..., 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
recvfrom(4, "$\0\0\0\2\0\0\0\4\0\0\0\321t\0\0\0\0\0\0p\0\0\0Q\4\5\0\4\0\0\0"..., 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
close(4) = 0
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f79aa20d0) = 29906
rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], NULL, 8) = 0
rt_sigaction(SIGTERM, {0x555a54716c, [], 0}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [ALRM TERM], NULL, 8) = 0
wait4(-1, Cannot execute /bin/bash: Permission denied