Not only pam chauthtok problems in privsep mode

[Rene Klootwijk]

Without giving a solution, I want to mention the following problem:

Not only changing expired passwords when privilege separation is enabled in 
combination with PAM is not working (although the current patches seem to 
solve this one). Also some PAM session modules do not work the way they are 
supposed to. For instance, the pam_lastlog module. This module gets and 
updates the last successful login attempt for a specific user 
in /var/log/lastlog. When privilege separation mode is enabled, not enough 
privileges are available to read and update lastlog (root:root 0640). 
Changing the permissions to 0666 (obviously not something you want to do) 
makes it work again. When privilege separation is disabled, everything 
works OK. One alternative could be to use the PrintLastLog option of 
OpenSSH, however see bug 463, also this does not solve the real problem and 
might leave us with the same problem with other PAM modules.


Regards,
Rene.