-
Title
Vastool status says "not configured for VAS" -
Description
/opt/quest/bin/vastool status reports:
FAILURE: 608 Pam <authexec><account> not configured for VAS.
FAILURE: 608 Pam <authexec><auth> not configured for VAS.
FAILURE: 608 Pam <authexec><password> not configured for VAS.
-
Cause
The authexec command was added after enabling VAS for the server, so its PAM configuration does not include the pam_vas library.
-
Resolution
FAILURE: 608 Pam <service> is saying that service is not configured for pam which means you will not be able to login with your active directory account to that service.
If you do not need to login to the application or service account with an AD account this message can be safely ignored. If you do need to then you can try to configure it with vastool configure pam.
To configure a pam compiled service you can do the following command:
/opt/quest/bin/vastool configure pam <service>
Enable authexec with the following command:
/opt/quest/bin/vastool configure pam authexec
If you do not want Pam message to appear when the /opt/quest/bin/vastool status command is run, there are two way to avoid seeing the Pam message:
1 - You can run /opt/quest/bin/vastool status -q to skip the pam service checkThe -q is the QUICK option:# 0.6.5# * New option, QUICK. Skips some of the slower/expensive checks.# Better for running during production. All tests still recommended# occasionally.2 - You can set the system environment value:# 0.1.4# * New option: SKIP_PAM_SERVICES, if that variable is set to anything# then the pam service specific tests will be skipped. i.e.:# SKIP_PAM_SERVICES=1 ./vas_status.sh -
Additional Information
This command can be used to enable VAS for any PAM service:
/opt/quest/bin/vastool configure pam <service-name>