Skip to content

Make pam_loginuid.so optional for ssh

username-removed-887420 requested to merge gagern/omnibus-gitlab:patch-2 into master

This is in line with current Docker examples and avoids errors due to lack of CAP_AUDIT_WRITE or some other error encountered while setting the process attribute.

Such errors would manifest as error messages like the following:

PAM: pam_open_session(): Cannot make/remove an entry for the specified session

Theoretically the CAP_AUDIT_WRITE problem in the default configuration should be gone since Docker 1.2.0. But people might want to set their capabilities differently. We've recently encountered problems with Debian Jessie resp. Linux 3.16 and Docker 1.12.5. The error message was the one quoted above, and disabling the pam_loginuid.so module resolved it. Not sure what the actual cause was; the log didn't say.

This is a spin-off from https://gitlab.com/gitlab-org/omnibus-gitlab/issues/1591#note_20242564.

Merge request reports