1
vote
0answers
33 views

How to add two-factor authetntication to ssh?

I am trying to add 2FA to sshd using PAM from oathtool package. I want two ways to login to server: publickey and 2FA, or password and 2FA So far I managed to add 2FA to publickey authentication, ...
0
votes
1answer
36 views

How to I authenticate with Dovecot + IMAP + PAM on CentOS?

I set up Dovecot IMAP to use PAM as suggested here: http://wiki2.dovecot.org/PasswordDatabase/PAM PAM/dovecot [root@ip-172-31-15-65 pam.d]# cat dovecot #%PAM-1.0 auth required ...
-1
votes
1answer
50 views

User authentication; PAM or Radius? [closed]

At college I'm part of a group of students that keep a server infrastructure running for the students. Lately we've been having a lot of trouble with the servers, and we decided that it's probably ...
0
votes
0answers
13 views

libnss-pgsql logging transaction on screen

I've been configuring a pg database to authenticate user against pam. I installed libpam_pgsql and libnss_pgsql2. After I finish configuring the libnss_pgsql2, creating and editing the nss-pgsql.conf ...
1
vote
1answer
65 views

Use a PHP script to authenticate users on Linux

I have a web application running built in PHP using MySQL as database. I'm trying to give specific users access to a Linux system via SSH to perform simple command-line tasks. Since I do already have ...
0
votes
0answers
127 views

Netatalk authentication randomly fails over WiFi

Background info: I have an Ubuntu 12.04 server on which I have Samba (v3.6.3) and Netatalk (v3.1.0) installed. I use TimeMachine on my Mac to backup to the Ubuntu server over AFP provided by ...
1
vote
1answer
30 views

vsftpd Unable to log in to ftp using Berkeley DB database file by PAM?

I have install vsftpd service on ubuntu 12.04 and i need to user virtual users. So i configured it by https://help.ubuntu.com/community/vsftpd article. When i ftp to my server, it make error 530, and ...
0
votes
0answers
82 views

How to ask memcached auth connection by sasl and pam?

I use memcached in a untrust network, so I try to use sasl and pam to auth connection to memcached. I installed sasl and pam module, compiled and installed memcached with sasl enabled. Also I created ...
0
votes
0answers
22 views

first login/password change ldap -> call script on local machine

i have machines which authenticate against openldap using pam_ldap. I would like to be able to call shell scripts somehow (to update services which don't integrate with ldap) (which should be ...
3
votes
2answers
248 views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
3
votes
1answer
232 views

How to make exception in password locking via pam_tally2 for specific user?

I need to make an exception for a specific user, so that his failed logins are not counted by pam_tally2, and well, this is not a root account (I'd use magic_root then). Is it doable?
2
votes
1answer
212 views

How can I limit failed sasl2/pam_mysql login retries?

I have Postfix setup serving multiple virtual domains on a CentOS box - and all works as expected. Client's login are authenticated through sasl2 (saslauthd) and pam_mysql. And when a login attempt ...
0
votes
1answer
74 views

LDAP queries for local users

Recently, in the company where I work, we have had a general system crash and we are figuring out the causes. Our machines are configured for LDAP authentication plus some local users in some of them. ...
0
votes
2answers
151 views

PAM LDAP configuration for non-local user authentication

I have a requirement to allow non-local user accounts to be logged in via LDAP authentication. Meaning, the user that is trying to login is allowed access, if the user account exists in LDAP server ...
3
votes
3answers
105 views

Is there a command line two-factor authentication verification code generator?

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup ...
0
votes
1answer
102 views

Lag between PAM password acceptance and session open on CentOS5

I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
0
votes
2answers
167 views

Can't get pam_time.so to work with http

The /etc/security/time.conf man page contains this example: All users except for root are denied access to console-login at all times: login ; tty* & !ttyp* ; !root ; !Al0000-2400 For this ...
2
votes
1answer
58 views

configuring pam with flat files backend

I would like to configure pam module to use flat files for authentication. Basically I need same thing like pam_unix just with possibility to use different files (other than /etc/passwd and ...
0
votes
0answers
310 views

Why would Dovecot POP3 and IMAP Authentication from external IP address stop working?

Over a year ago I setup a Dovecot 1.2.9 POP3/IMAP server (which works alongside a Postfix SMTP server) with PAM authentication. This has been operating (I believe) without incident until recently ...
1
vote
1answer
300 views

Ubuntu 12.10 - Can't find my logs

Up until few days ago, my Ubuntu 10.04 worked like a clock. Then I switched to Ubuntu 12.10 and things don't work the same way with this setup. First, the new system wasn't logging any mail activity, ...
1
vote
1answer
165 views

MariaDB + PAM: Is Remote Auth Secure?

I have a MariaDB instance which is using PAM to auth against Active Directory. Is remote authentication with this service secure? I ran a Wireshark trace during the auth process, and passwords are not ...
2
votes
1answer
478 views

How do I disable password complexity in pam

I found tons of articles how to enable password complexity, can someone guide me to how to disable it? (oracle linux) This is my system-auth #%PAM-1.0 # This file is auto-generated. # User changes ...
0
votes
1answer
2k views

How do you configure /etc/pam.d/system-auth-ac on CentOS 6 using authconfig?

I'm trying to replace the cracklib module with passwdqc. Every time I do an authconfig --update (or --updateall), the changes I make on the system-auth-ac file goes away. The authconfig command line ...
12
votes
2answers
206 views

SSH only works after intentionally failed password

So, I'm having a rather weird problem. I have a server, that when I try to SSH into, immediately closes the connection if I type in the correct password on the first attempt. However, if I ...
1
vote
0answers
392 views

CentOS PAM+LDAP login and host attribute

My system is CentOS 6.3, openldap is configured well, PAM authorization works fine. But after turning pam_check_host_attr to yes, all LDAP-auths fail with message "Access denied for this host". ...
1
vote
3answers
47 views

Rip authentication from LDAP to local

We are taking a small portion of our network offline, and running a separate network using that portion. (By small portion I mean 2 servers, that will be connected to 30 odd boxes that aren't usually ...
5
votes
2answers
835 views

Nginx with PAM authentication through pam_script

Have anyone set up such a configuration? It's not working for me. I've installed nginx-extras on Ubuntu 12.04 (it's built with PAM module), and added to site config: location ^~ /restricted_place/ { ...
2
votes
4answers
2k views

PAM module causes flurry of SSH sessions

While tailing /var/log/auth.log I noticed that there where multiple entries being entered (instantly) by the minute for user "foo". I personally had only one connection open as user "root_bar" while ...
1
vote
2answers
461 views

LDAP and pam without binddn and anonymous access

I am working in a large company and can use its central read-only LDAP server remotely. The LDAP server does not allow anonymous binding. In order to use this server for authentication of the users on ...
1
vote
2answers
817 views

How to use PAM to limit failed login attempts by IP?

I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
0
votes
1answer
253 views

login faild when autorize dovecot from pam

I installed dovecot 2.0.13 with postfix in ubuntu server 11.10 , after installation I can send e-mail with the mail command and dovecot works when I test it with telnet I then installed roundcube on ...
4
votes
1answer
2k views

How to use nginx PAM module?

I would like to use nginx PAM module to authenticate a site with existing users on a FreeBSD system. I tried to use pam_unix.so, but no luck. It's just not let me in with my usr/psw pair. :( nginx ...
1
vote
1answer
980 views

Account lockout using Openldap

What is the best way to implement account lockout in openldap? I have an openldap server with Ubuntu desktop client connecting to it for authentication. I want he accounts to locked out after say 5 ...
4
votes
6answers
2k views

How to customize telnet login prompt on linux

When I run login command on debian, I get: hostname login: _ on RHEL5, Solaris or HP-UX I get: login: _ I need to be able to customize login: and password: prompts it on a Linux box. I can ...
3
votes
2answers
674 views

Account lockout in Ubuntu

I am trying to implement account lockout for Ubuntu systems using pam_tally. The login should be disabled for certain interval on 3 invalid login attempts. This should happen for both system and LDAP ...
0
votes
1answer
579 views

Google Authenticator PAM for specific users

My current sshd PAM config: #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session ...
0
votes
2answers
2k views

Cyrus on CentOS with sasl / pam / ldap

SASL/PAM/LDAP is driving me crazy... that's what I read a lot when googling for problems in this area, and what I experience myself :-S I'm trying to get Cyrus imap working for virtual hosting on ...
4
votes
3answers
2k views

libpam-ldap or libpam-ldapd?

I'm setting up LDAP authentication on my personal VPS, and Ubuntu has two packages for the same purpose: libpam-ldap and libpam-ldapd. Which should I use?
1
vote
1answer
653 views

pam_exec.so PAM module does not export variable PAM_USER as stated in the documentation

I'm trying to use the pam_exec.so PAM module to execute a script which needs to know the username/password coming from the application (OpenVPN in this case). I have a script that executes printenv ...
1
vote
1answer
890 views

PAM: How can I create a service which passes username/password to a script?

I'm setting up a PAM service for OpenVPN, such that the OpenVPN PAM module can authenticate a username/password to an external service that I will implement using a shell script. The OpenVPN PAM ...
1
vote
3answers
87 views

Using a database to authenticate linux users

How can I use a database of some sort to contain a list of valid linux users that can be used to allow them to login to the system as well as FTP in? My situation is that I need allow new user logins ...
0
votes
1answer
336 views

Is it a bug that pam-auth-update does not enable SSSD even when checked?

I am using sssd to authenticate and identify users from AD using Kerberos and LDAP, however, I have to add auth/session/account sufficient pam-sss.so to /etc/pam.d/common-* files even if I check SSS ...
1
vote
3answers
2k views

Samba File Server + PAM + Berkeley DB or Samba + PAM

I've set up VSFTPD with PAM and Berkeley DB before using this article. It's a great article and was really easy to walk through setting it up. Now that I'm setting up Samba, I would like to do the ...
1
vote
1answer
381 views

map remote ssh user to a different local user

All my boxes have the same username for myself, except one legacy machine where I'm loath to try to change it. Whenever I ssh to the machine, I forget to specify my user name, and my password is ...
1
vote
1answer
448 views

Is giving read permissions on /etc/shadow to apache user a wise decision from security point of view?

I have to use PAM authentication for DAV SVN, but when everything is configured as specified in mod_auth_pam documentation, authentication does not work. After some research I realized, that for this ...
3
votes
3answers
1k views

Linux Remote Desktop with username/password authentication

The environment at the moment is a selection of windows and Linux (RHEL 4/5 and SLES 10/11) whereby VNC access to the windows boxes works using ultravnc and providing a username/password combination ...
0
votes
1answer
436 views

FreeBSD 7.0 Kerberos Login over SSH, But Not Console

I assume there is an easy solution to this, but I prefer to ask before mucking up our intranet server. During a support session, my co-worker and I realized we could login in with our Kerberos ...
0
votes
1answer
387 views

Do I need both nss_ldap and pam_ldap?

This seems like a dumb question, but... do I need both nss_ldap and pam_ldap to have my users in LDAP? It seems to me that pam_ldap would take care of pointing everything at the LDAP server as ...
6
votes
5answers
4k views

Linux authentication via ADS — allowing only specific groups in PAM

I'm taking the samba / winbind / PAM route to authenticate users on our linux servers from our Active Directory domain. Everything works, but I want to limit what AD groups are allowed to ...
0
votes
1answer
416 views

PAM cracklib vs login.defs

If there are different parameters set for minimum password length in pam_cracklib and login.defs. Which takes precedence ? Any good docs/books about PAM ?