Voici la solution que j’ai utilisé pour corriger un problème rencontré avec une fedora core 2 qui utilise dovecot comme serveur POP3.
Je rencontrais ce message dans le fichier secure et dans le détail de logwatch.
dovecot-auth: pam_succeed_if: requirement "uid < 100" not met by user "user1"
dovecot-auth: pam_succeed_if: requirement "uid < 100" not met by user "user2"
dovecot-auth: pam_succeed_if: requirement "uid < 100" not met by user "user2"
dovecot-auth: pam_succeed_if: requirement "uid < 100" not met by user "user3"
dovecot-auth: pam_succeed_if: requirement "uid < 100" not met by user "user1"
Pour éviter ce message, il suffit de modifier le fichier /etc/log.d/conf/services/secure.conf en ajoutant dovecot-auth à la section $ignore_services, comme ceci :
###########################################################################
# $Id: secure.conf,v 1.10 2002/10/18 18:58:01 kirk Exp $
###########################################################################
# You can put comments anywhere you want to. They are effective for the
# rest of the line.
# this is in the format of
# and end of the lines is removed. Whitespace before and after the = sign
# is removed. Everything is case *insensitive*.
# Yes = True = On = 1
# No = False = Off = 0
Title = "Connections (secure-log)"
# Which logfile group...
LogFile = secure
# Whether or not to lookup the IPs into hostnames...
# Setting this to Yes will significantly increase runtime
$secure_ip_lookup = No
# Use this to ignore certain services in the secure log.
# You can ignore as many services as you would like.
# (we ignore sshd because its entries are processed by the sshd script)
$ignore_services = sshd Pluto stunnel proftpd dovecot-auth
# For these services, summarize only (i.e. don't least each IP, just
# list the number of connections total)
#$summarize_connections = ftp
########################################################
# This was written and is maintained by:
# Kirk Bauer
#
# Please send all comments, suggestions, bug reports,
# etc, to kirk@kaybee.org.
########################################################
Relancer syslog avec la commande /etc/init.d/syslog restart
Une autre solution, que j'ai trouvé sur le net propose de commenter une ligne du fichier /etc/pam.d/system-auth qui modifie ainsi la gestion des sécurités qu'effectue PAM.
Il suffit de commenter la ligne "account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100" du fichier en question pour que Pam n'impose plus la limite d'uid aux services de la machine.
Ceci donne le fichier /etc/pam.d/system-auth suivant :
#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth required /lib/security/$ISA/pam_env.so
auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
auth required /lib/security/$ISA/pam_deny.so
#account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 account required /lib/security/$ISA/pam_unix.so password requisite /lib/security/$ISA/pam_cracklib.so retry=3 password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5 shadow password required /lib/security/$ISA/pam_deny.so session required /lib/security/$ISA/pam_limits.so session required /lib/security/$ISA/pam_unix.so [root@mail services]#
Je n'ai pas retenu cette solution un peu hard à mon goût.
Elle est d'ailleurs déconseillée si le serveur sert de serveur de fichier NFS.