It appears there were recent changes to how Infisical is handling PAM. These changes have resulted in me being completely locked out of three instances I have running. There are not running critical workloads so it's really more of an annoyance than an incident. Traditionally I was able to view password credentials for accounts in PAM and now we are not. This wouldn't necessarily be a bad thing but the SSH connections are no longer working and some of resources didn't have passwordless sudo abilities. Is there anyway to resolve this and regain the credentials or am I stuck having to reinstall the OS on these machines? Also the changes to the CLI client have completely borked my CI workloads, but there again from a recent conversation I had with someone at Infisical that was foreseeable since I was using PAM instead of dynamic passwords. I will say though, locking dynamic passwords behind enterprise and having PAM open is probably going to drive people in this direction.

Hey @Ernest Mallett! Thanks for reaching out. You're right that we've made changes to our PAM implementation. To give some context: PAM is a major product area that's currently in active development. To clarify your situation: SSH session launches should still work as expected. The change is that viewing stored credentials (the actual password values) through the UI or API isn't currently supported in the new model. We plan to add that capability in a future release. If you're seeing SSH connections fail entirely, that would be unexpected. Could you share more detail on what error you're hitting? Happy to dig in and help troubleshoot. For the instances where you need the password for sudo, without the view-credentials feature there's no way to retrieve them from Infisical at the moment. If you have alternative access to those machines (console, recovery mode, another privileged account), you can reset the passwords that way. Otherwise, resetting the machines would be the path forward. For release notes, right now we publish them with each OSS release on GitHub (github.com/Infisical/infisical/releases)

Thanks for reaching back out Sheen! I appreciate the details. To give some insight into why it's failing. It appears the CLI tool has removed a lot of commands from the PAM side. Specifically, locally I used to do

infisical pam ssh access (flags)

to get a direct shell and in my CI pipelines I would do

infisical pam ssh proxy (flags)

but recently it has changed to only allowing

infisical pam access (flags)

which is what broke my pipelines and some workflows. Looks like some docs may be out of date too (pretty much everything in regards to PAM snippets in the docs).

For the instances where you need the password for sudo, without the view-credentials feature there's no way to retrieve them from Infisical at the moment.

I was worried that was going to be the answer. 😅 Thankfully though these are not critical machines, so doing a reset isn't going to really destroy anything.