Solars 11.4 OS upgrade breaks authentication, users cannot login. Install the supported version 4.1.7.23754 prior to upgrading the Solaris OS to 11.4 (4249363)

Solars 11.4 OS upgrade breaks authentication, users cannot login. Install the supported version 4.1.7.23754 prior to upgrading the Solaris OS to 11.4

After upgrading to the Solaris OS from 11.3 to 11.4 with a version of Authentication Services older than 4.1.7.23754 users can no longer log in.

Upgrading to Authentication Services 4.1.7.23754 post OS upgrade does not resolve.

 

 

The pam configuration file "/usr/lib/security/pam_authtok_common" is not used on Solaris 11.3 however it is on Solaris 11.4.

If this configuration file is in a state other than the default when upgrading the OS to version 11.4 with a previous version of Authentication Services installed it breaks authentication. 

1) Upgrade Authentication Services on the system to a release that supports Solaris 11.4 (Authentication Services 4.1.7.23754 or newer) prior to upgrading the OS to 11.4.

2) clean up /usr/lib/security/pam_authtok_common so that it just has the comments and the following:

other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1 force_check

3) Upgrade to 11.4.

4) Run "/opt/quest/bin/vastool configure pam" to upgrade the new added pam.d files

The supported version of Authentication Services 4.1.7 can be downloaded here:

https://support.oneidentity.com/authentication-services/kb/228689/

Please note the following non Authentication Services related issues that were discovered when upgrading to Solaris 11.4 from Solaris 11.3:

1) Post upgrade the sysadmin group membership was wiped out which caused sudo errors.

- Mounted the 11.4 image from the working 11.3 image and fixed the file ( /mnt/etc/group ).

2) Newer sshd doesn't support dss keys, so if passwordless auth fails after upgrade add the following to /etc/ssh/sshd_config and restart the sshd daemon.

PubkeyAcceptedKeyTypes=+ssh-dss

If the system has already been upgraded to 11.4 with an unsupported of Authentication Services installed. 1) Upgrade Authentication Services to a supported version. 2) unconfigure pam /opt/quest/bin/vastool unconfigure pam 3) Put down a default /usr/lib/security/pam_authtok_common file if it isn't already set as below: other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 force_check 4) configure pam /opt/quest/bin/vastool/configure pam 5) Test