INTERNAL ONLY: RHEL 6 with SecurID PAM 7.0 agent throws error 'cannot enable executable stack as shared object requires: Permission denied'
3 months ago
Originally Published: 2011-09-27
Article Number
000050503
Issue
INTERNAL ONLY: RHEL 6 with SecurID PAM 7.0 agent throws error "cannot enable executable stack as shared object requires: Permission denied"
If you tail /var/log/secure with pam in debug mode, the following errors show up:

Sep 27 15:40:07 fog sshd[14354]: error: PAM: Module is unknown for testuser
Sep 27 15:40:07 fog sshd[14354]: Connection closed by 192.168.131.196
Sep 27 15:59:33 fog sshd[14459]: PAM unable to dlopen(/lib64/security/pam_securid.so): /lib64/security/pam_securid.so: cannot enable executable stack as shared object requires: Permission denied
Sep 27 15:59:33 fog sshd[14459]: PAM adding faulty module: /lib64/security/pam_securid.so
Sep 27 15:59:33 fog sshd[14459]: error: PAM: Module is unknown for testuer from ssh.myhost.com
Sep 27 15:59:33 fog sshd[14459]: Connection closed by 192.168.131.196
Sep 27 16:02:57 fog sshd[14498]: PAM unable to dlopen(/lib64/security/pam_securid.so): /lib64/security/pam_securid.so: cannot enable executable stack as shared object requires: Permission denied
Sep 27 16:02:57 fog sshd[14498]: PAM adding faulty module: /lib64/security/pam_securid.so
Sep 27 16:02:57 fog sshd[14498]: error: PAM: Module is unknown for testuer from ssh.myhost.com
Sep 27 16:02:57 fog sshd[14498]: Connection closed by 192.168.131.196

Cause
RHEL 6 is currently not a supported platform, but the agent will work. It is important that the disclaimer of "not supported" as of the writing of this primus solution is relayed to customers.  The same issue has been observed with the PAM agent on SUSE linux and Cent/OS - both as well unsupported platforms.

Resolution
This is caused by SELinux being enabled on RHEL 6. SELinux has to be disabled in order to load the PAM module.

1. cd /etc/selinux
2. edit config
3. add to the bottom of the file
    setenforce 0
4. save the file

Additional information on SELinux is available in the manpage for SELinux
  http://linuxcommand.org/man_pages/setenforce8.html

Until such time as the agent is officially qualified on whatever platform displays this error, this can be used as a workaround.  There is no official support available for RHEL 6 at the time of this writing.  This workaround has been observed as unnecessary on RHEL 4 or RHEL 5.

Related Articles

Trending Articles

Don't see what you're looking for?