-
Title
Solaris 11.X 11.4 noannotation.so users cannot login -
Description
Users can't login after upgrading a Solaris 11.4 system that has Authentication Services 4.1.x upgraded to Authentication Services 4.2.x or 5.x.Additional errors that are shown at Solaris logs are:/var/adm/messages: can not open module /usr/lib/security//64/noannotation.so -
Cause
A Solaris system that has installed Authentication Services 4.1.x has an incorrect parsing entry added to PAM module configurations.This incorrect entry will persist install/uninstall procedures of Authentication Services 4.2.x and up.
the incorrect entry is (example):# cat sshd-hostbasedauth required noannotation.soIn Solaris systems there is no library called noannotation.so. A piece of parsing code in the 4.1.x series of Authentication Services incorrectly created this entry while also correctly modifying the PAM libraries.
Example sshd-hostbased PAM file:
auth required pam_unix_cred.so.1 noannotation #Adding noannotation here is the correct procedure.auth required noannotation.so #Adding this entry making a reference to an invalid library noannotation.so is incorrect.auth definitive pam_user_policy.so.1 -
Resolution
In Authentication Services 4.2.x and up the error was later corrected for Solaris systems including Solaris 11.4.
If you install or uninstall Authentication Services 4.2.x and up and this incorrect entry is already inserted then it will not be removed. It must be removed manually.
In order to avoid authentication errors, please open the affected PAM modules and look for and delete the line that says:
auth required noannotation.so
Once you remove that line, the system will allow users to login.
-
Change Request
283832 -
Additional Information
References: Solaris pam_unix_cred(7) . pam_unix_cred - PAM user credential authentication module for UNIX. part of pam_unix_cred.so.1