PAM authentication issue

[darshankowlaser]

Hello

Below are the details of the system running FRR :

FRR - 9.0.1
OS - Debian 11 (bullseye)
KERNEL - 5.10.0-26-amd64

When trying to access vtysh via a non-root user we get the following error, upon successfully accessing the vtysh shell :

vtysh_pam: Failed in account validation: Permission denied(6)
Hello, this is FRRouting (version 9.0.1).
Copyright 1996-2005 Kunihiro Ishiguro, et al.

FRR-T-01#

I'm able to get into the tty just fine, just curious to why this vtysh_pam: Failed in account validation: Permission denied(6) is being displayed. The user that is accessing vtysh has the following permissions :

root@FRR-T-01:~# groups lgserver
lgserver : lgserver frrvty frr

Prior to updating to 9.0.1 this wasn't the case, I've checked at various forums but cannot find any solutions for the above so I thought I'd bring it to your attention.

Thanks,

[ton31337]

How /etc/pam.d/frr looks like in your machine?

[darshankowlaser]

Hi

Below is the output :

root@FRR-T-01:~# cat /etc/pam.d/frr 
# Any user may call vtysh but only those belonging to the group frrvty can
# actually connect to the socket and use the program.
auth    sufficient      pam_permit.so
account sufficient      pam_rootok.so

The user is apart of the frrvty group as well shown in my initial comment. Also I prefer not giving sudo access to this user to fix, the user account is used for my looking glass.