Message "Module is unknown" when trying to rsh to the server

Solution Verified - Updated -

Environment

RHEL 6
RHEL 7
sshd
rsh
pam

Issue

When trying to rsh to a server, this message is displayed:

Module is unknown
rlogin: connection closed

and the connection is interrupted.

Resolution

Remove any suspicious module in /etc/pam.d/remote, for example:

auth       required     pam_rhosts_auth.so

and

ls -l /usr/lib64/security/pam_rhosts_auth.so
ls: cannot access /usr/lib64/security/pam_rhosts_auth.so: No such file or directory

Root Cause

  • If a pam module is marked as required and is not available, the authentication can not be complete and the the connection is interrupted:
    If we look at the man page of pam.d(5):
required
failure of such a PAM will ultimately lead to the PAM-API returning failure but only after the remaining stacked modules (for this service and type) have been invoked.

Diagnostic Steps

  • You can see some PAM error messages regarding login in /var/log/secure:
Nov 29 21:59:19 localhost login: PAM unable to dlopen(/usr/lib64/security/pam_rhosts_auth.so): /usr/lib64/security/pam_rhosts_auth.so: cannot open shared object file: No such file or directory
Nov 29 21:59:19 localhost login: PAM adding faulty module: /usr/lib64/security/pam_rhosts_auth.so
Nov 29 21:59:24 localhost login: FAILED LOGIN SESSION FROM localhost FOR root, Module is unknown

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments