Description

This article provides information about how the /var/etc/pam.conf file related to Tacacs issue and clear the warning message.

Symptoms

  1. Tacacs not working.
    1. Switch will not authenticate the user using Tacacs+.
    2. Switch will not send the authentication request to the Tacacs+ (Please confirm that we have correct configuration and route to reach the Tacacs server)
 
      2. Commit complete with warning. 

Output:
 
{master:0}
root@jtac-EX4200> configure
Entering configuration mode
 
{master:0}[edit]
root@jtac-EX4200# commit
   fpc0:
   configuration check succeeds
   error: rename failed for /var/etc/pam.conf
   commit complete

Solution

                                 Pam.conf >> Password authentication management file

                               
                                It contains the order of authentication method to be used for any user logging into the chassis.
                                          Note: This order is based on the configuration “set system authentication-order”.
 
Meaning of error message rename failed for /var/etc/pam.conf:
 
Whenever a change to pam.conf is made,
  1. Changes are written to pam.conf+ file.
  2. Once all changes are written, flags on pam.conf are removed
  3. pam.conf+ file is renamed to pam.conf
  4. schg and sunlink flags are set again on pam.conf
If rename step fails, then "error: rename failed for /var/etc/pam.conf" is flagged.
 
Meaning of schg and sunlink flags:

schg    "system immutable flag"
sunlink >> The sunlink flag prevents everyone, including the root user, from deleting (unlinking) the flagged file.
This overrides any Unix filesystem permissions that otherwise might allow file deletion

These flags are linked to pam.conf that has the order of authentication which is affecting the Tacacs communication.

                                
  1. Start the shell as user root
root@jtac-EX4200> start shell
   root@jtac-EX4200%
 
      2. Issue the following command:
root@jtac-EX4200% chflags 0 /var/etc/pam.conf
 
      3. Check the Tacacs+ authentication and commit result.

Related Information