Uninstalling PAMSC on Linux Leaves /etc/pam.d/system-auth-ac Behind

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

After uninstalling the PAMSC endpoint, the file system-auth-ac is left behind, which was not there prior to the installation.

Before the PAMSC Installation:

[root@demo-rhel9 ~]# ls -lh /etc/pam.d/*-auth*
-rw-r--r--. 1 root root 701 Nov 22  2024 /etc/pam.d/fingerprint-auth
-rw-r--r--. 1 root root 760 Nov 22  2024 /etc/pam.d/password-auth
-rw-r--r--. 1 root root 743 Nov 22  2024 /etc/pam.d/smartcard-auth
-rw-r--r--. 1 root root 760 Nov 22  2024 /etc/pam.d/system-auth

After PAMSC Installation:

[root@demo-rhel9 ~]# ls -lh /etc/pam.d/*-auth*
-rw-r--r--. 1 root root 685 Sep 30 21:45 /etc/pam.d/fingerprint-auth
-rw-r--r--. 1 root root 786 Sep 30 21:45 /etc/pam.d/password-auth
-rw-r--r--. 1 root root 730 Sep 30 21:45 /etc/pam.d/smartcard-auth
lrwxrwxrwx. 1 root root  14 Sep 30 21:45 /etc/pam.d/system-auth -> system-auth-cm
-rw-r--r--. 1 root root 786 Sep 30 21:45 /etc/pam.d/system-auth-cm

After PAMSC Uninstallation:

[root@demo-rhel9 ~]# ls -lh /etc/pam.d/*-auth*
-rw-r--r--. 1 root root 587 Sep 30 21:50 /etc/pam.d/fingerprint-auth
-rw-r--r--. 1 root root 656 Sep 30 21:50 /etc/pam.d/password-auth
-rw-r--r--. 1 root root 632 Sep 30 21:50 /etc/pam.d/smartcard-auth
lrwxrwxrwx. 1 root root  25 Sep 30 21:50 /etc/pam.d/system-auth -> /etc/pam.d/system-auth-ac
-rw-r--r--. 1 root root 656 Sep 30 21:50 /etc/pam.d/system-auth-ac

Environment

PAM Server Control 14.x on RHEL8 and above

Resolution

Per its man page, he system-auth-ac file is a file native to the system and used with the authconfig command. However, authconfig was deprecated per the RHEL8 Release Notes and the system-auth-ac file is no longer in use on newer RHEL releases.

DE648682 is currently open with engineering for them to determine how to update the uninstaller going forward.