The Pluggable Authentication Modules (PAM) is a component of the Linux system. PAM provides dynamic authentication support for applications and services. If the configuration of the system causes the configured PAM authentication procedure to fail, the OCP-Agent pos_proxy process will not be able to run commands.
Problem
When you run OCP-Agent 2.4.0 or later versions on a Linux system, such as Red Hat, CentOS, or AliOS 7, and
add a host, a sub-task failed and the
sudo: pam_open_session: Permission deniederror appears in the log.deploy a cluster, a sub-task failed and the
sudo: pam_open_session: Permission deniederror appears in the log.deploy OBProxy, a sub-task failed and the
sudo: pam_open_session: Permission deniederror appears in the log.
Possible causes
The configured PAM of the Session type failed to authenticate the status of the corresponding operations. General causes include:
An error occurred while authenticating sudo permission: You have not granted the required permission for the corresponding user to access the
/etc/sudoersfile.An error occurred while authenticating the system resource constraint configuration: You have configured improper system resource constraints by using the ulimit command or in the
/etc/security/limits.conffile.
Solutions
If you are not sure about the specific cause, try the following methods one by one to solve the problem.
When the failure is caused during sudo permission authentication, perform the following steps to grant the required sudo permission to the corresponding user.
When the failure is caused during system resource constraint configuration, try the following two solutions: