INTERNAL ONLY: RHEL 6 with SecurID PAM 7.0 agent throws error 'cannot enable executable stack as shared object requires: Permission denied'

2 months ago

Originally Published: 2011-09-27

Article Number

000050503

Issue

INTERNAL ONLY: RHEL 6 with SecurID PAM 7.0 agent throws error "cannot enable executable stack as shared object requires: Permission denied"

If you tail /var/log/secure with pam in debug mode, the following errors show up:

Sep 27 15:40:07 fog sshd[14354]: error: PAM: Module is unknown for testuser

Sep 27 15:40:07 fog sshd[14354]: Connection closed by 192.168.131.196

Sep 27 15:59:33 fog sshd[14459]: PAM unable to dlopen(/lib64/security/pam_securid.so): /lib64/security/pam_securid.so: cannot enable executable stack as shared object requires: Permission denied

Sep 27 15:59:33 fog sshd[14459]: PAM adding faulty module: /lib64/security/pam_securid.so

Sep 27 15:59:33 fog sshd[14459]: error: PAM: Module is unknown for testuer from ssh.myhost.com

Sep 27 15:59:33 fog sshd[14459]: Connection closed by 192.168.131.196

Sep 27 16:02:57 fog sshd[14498]: PAM unable to dlopen(/lib64/security/pam_securid.so): /lib64/security/pam_securid.so: cannot enable executable stack as shared object requires: Permission denied

Sep 27 16:02:57 fog sshd[14498]: PAM adding faulty module: /lib64/security/pam_securid.so

Sep 27 16:02:57 fog sshd[14498]: error: PAM: Module is unknown for testuer from ssh.myhost.com

Sep 27 16:02:57 fog sshd[14498]: Connection closed by 192.168.131.196

Cause

RHEL 6 is currently not a supported platform, but the agent will work. It is important that the disclaimer of "not supported" as of the writing of this primus solution is relayed to customers. The same issue has been observed with the PAM agent on SUSE linux and Cent/OS - both as well unsupported platforms.

Resolution

This is caused by SELinux being enabled on RHEL 6. SELinux has to be disabled in order to load the PAM module.

1. cd /etc/selinux
2. edit config
3. add to the bottom of the file
setenforce 0
4. save the file

Additional information on SELinux is available in the manpage for SELinux
http://linuxcommand.org/man_pages/setenforce8.html

Until such time as the agent is officially qualified on whatever platform displays this error, this can be used as a workaround. There is no official support available for RHEL 6 at the time of this writing. This workaround has been observed as unnecessary on RHEL 4 or RHEL 5.

Don't see what you're looking for?

Related Articles

Trending Articles