Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
1answer
14 views

configure a PAM module to be required for all but certain users for which it should be sufficient

I'd like to be able to configure /etc/pam.d/sshd so that: for all users except those in group "admin", module pam_radius is required. for those users in group admin, module pam_radius is ...
1
vote
1answer
13 views

Detect SSSD authenticating domain programmatically in multi-domain environment

We have some servers in a mixed RH5/RH6 enthat need to authenticate to one of two LDAP services. This is implemented in SSSD and is running fine. Users from either domain can login successfully and ...
2
votes
0answers
25 views

Mac OSX - SSHD partially broken after El Capitan Upgrade

I recently upgraded my firm's Mac Mini device to El Capitan from Yosemite, and encountered several issues during the upgrade. I've gotten most of them resolved but one that's still failing is the SSH ...
0
votes
0answers
11 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
1
vote
1answer
38 views

OpenSSH use (public key or password) + google authenticator

I want to allow these two authentication types: public key + google authenticator OR password + google authenticator. I have the following in my sshd_config: AuthenticationMethods ...
0
votes
0answers
24 views

Getting more info with PAM auth

I'm trying to setup a SOCKS authentication using PAM. I'm using a custom python file as a pam module to authenticate users but the problem is that I can't seem to pass all the informations needed to ...
0
votes
0answers
6 views

ocredit ignored in PAM config

oscap is reporting that ocredit requirements are not being met. Current system-auth config: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth ...
2
votes
1answer
31 views

Security implications when only allowing logins via key and UsePAM setting is 'yes'?

When setting up a new server, I generally want to allow logins only via key authentification and not from the root user. Therefore, I edit the sshd_config like this: I change 'PermitRootLogin' to ...
0
votes
1answer
15 views

ldap-overlay with fixed default attributes

i'm having a largish user-base (>>1000) which should be able to collectively use some sharing service. the user base is slowly but constantly changing. esp. we are not interested in privilege ...
0
votes
2answers
26 views

pam_groupdn doesn't work at all. always all users allowed to log in

i have tried to install pam, ldap on fedora23. i have configured pam.d/system-auth as follows: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time ...
1
vote
0answers
15 views

how to configure freeradius for separate Code and Password prompts, instead of a single Password prompt?

I've got a Freeradius server set up where the users in /etc/freeradius/users have Auth-Type := PAM. This makes radius refer to the /etc/pam.d/radiusd file, and in this file I have auth requisite ...
0
votes
0answers
18 views

Webmin authentication against LDAP

I want ultimately to authenticate Webmin user against one LDAP. I have read the page How can I make a Webmin user always use the same password as Unix?. According to this explanation, the ...
1
vote
1answer
22 views

Howto setup LDAP/Linux so when a user is deleted, its bash user session is immediately closed

Is there a way to setup OpenLDAP on a Linux (Redhat/CentOS) system so that when a user is removed from the LDAP server or he/she is removed from the "login is authorized" group, all his/her open ...
6
votes
1answer
84 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
4
votes
2answers
76 views

AWS Simple AD: “KDC has no support for encryption type” for users created with adtool, but not with MS Management Console

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with kerberos and ...
2
votes
1answer
35 views

SSH, Kerberos, AD: how / where to config /etc/pam.d/password-auth?

I have a CentOS 6 machine here and want to give SSH access for users from another forest, which is trusted. I got a temporary workaround, which is: 1) change content in /etc/pam.d/vncserver to auth ...
1
vote
1answer
41 views

OpenLDAP - How to restrict Debian login to specific groups (posixGroup)?

I'm trying to restrict login to specific LDAP groups in Debian 8. The system is configured to use OpenLDAP (PAM) as authentication method. My goal is to configure the system to allow all local users ...
0
votes
0answers
33 views

Problems using SSH with winbind authentication

I am trying to set up authentication against an Active Directory Server on a Debian Wheezy machine. So far, getent passwd/group works perfectly and shows me the network users/groups. wbinfo -u/-g ...
0
votes
2answers
71 views

login with active directory users on debian jessy not working

I'm trying to get the login with active directory users working for nearly a week now. First of all, I'm pretty new to pam, samba, kerberos and winbind. We worked with local users and sudo before, but ...
6
votes
2answers
118 views

Unable to login via PAM and ldap: failed to get password

I'm trying to have OpenVPN authenticate users via PAM over LDAP to an Active Directory server. Here are the relevant parts of my configuration files: /etc/openvpn/server.conf: # ... plugin ...
0
votes
1answer
55 views

Authentication based on any of the PAM module

I want to allow some users to only use SFTP but not SSH. Also I dont want these SFTP users ID and password to be stored in /etc/passwd file. I want their id and password details will be stored in a ...
3
votes
1answer
33 views

Kerberos authentication fails when local password is expired

I am using pam_krb5 with local accounts (Linux) for AD password authentication. Things are working great, users are able to authenticate with both AD and local passwords. I am having a problem ...
0
votes
0answers
39 views

How to set up libreswan with PAM and Google-authenticator for Mac Clients

I can't seem to get xauthby=pam working. I recompiled libreswan with PAM support. The VPN server does work when I set it up to use chap so I know the server is largely set up right. I'm following ...
1
vote
1answer
55 views

PAM with LDAP and add an exception for local user

I've successfully configured LDAP and SSH. Also I've added a requirement that user should be in admin group. That works. /etc/ldap.conf ... pam_groupdn cn=admin,ou=Groups,dc=example,dc=com ... ...
0
votes
1answer
50 views

SSH/SFTP to Centos 7 from Coda

I am running a droplet on DO with Centos 7 - from my mac terminal I can login as root (with password) without any problems. But if I try the same from Coda (editor) I run into problems. My audit log ...
1
vote
0answers
127 views

How to use SHA-256 hashed (and salted) passwords from OpenLDAP in pam_ldap?

I have hashed and salted passwords in OpenLDAP for login via PAM in Linux. The setup works when the hashes are of type SHA-1 (salted or unsalted) or plain text. In these cases everything works fine ...
0
votes
0answers
68 views

CentOS7 ldap client not authenticating with ldap server

I am using ApacheDS which was a breeze to setup thanks to the apacheds mailing list. I am able to retrieve ldapsearch results, however, I am not able to get anything by doing a:"getent passwd ". ...
0
votes
0answers
59 views

PAM - Ignore local user, if LDAP-connection works

I have configured some SLED10SP1 (not allowed to update) machines to use LDAP for user authentication. Because SLED10 doesn't have official packages for pam_ccreds or sssd, I have to find a way to ...
1
vote
1answer
207 views

SSH Authentication using RADIUS + Google Authenticator

I'm trying configure my SSHD's to authenticate users using FreeRadius. The FreeRadius server needs to first require a valid OTP using Google Authenticator, and then verify the system account password. ...
0
votes
0answers
45 views

pam_access nisnetgroup with nested posixgroup

We have pam_access enabled and correctly allowed/denying users based on the rules in place. One such rule looks up LDAP backed NIS groups + : @hostname-granted : ALL Putting tuples in ldap work for ...
5
votes
5answers
146 views

Filter LDAP user through PAM so it appears to not exist at all

In our corporate environment long ago some wiz decided to put the user "mysql" into LDAP. The account is disabled: $ sudo su - mysql This account is currently not available. ...but it's id still ...
1
vote
0answers
57 views

PAM Google Authenticator With SFTP And Other Apps

I'm attempting to set up a situation where SSH Authorized Key + Google Authenticator Code is sufficient to ssh into the server. This is working fine for normal SSH terminal operations - I'm prompted ...
0
votes
1answer
27 views

PAM standard macros and logging on CentOS7

According to the D(x) macro defined in pam_macros.h (source code) and used as follows: D(("Hello PAM World")); Where is this log located on CentOS7? Note that I am using as flag debug in my pam.d ...
0
votes
2answers
97 views

/var/log/secure reporting false positives

I have my CentOS 6 system configured to use sssd with ldap provider. I am able to login and use sudo, however /var/log/secure always reports authentication failure: Sep 18 07:09:52 serverA sudo: ...
0
votes
0answers
12 views

password changed by poppassd doesn't reflect smbpasswd

I have installed poppassd and coded a php script for users to change their passwords via web. However I noticed that what being changed via poppassd did not reflect users' samba password. Any pointers ...
1
vote
1answer
139 views

inactive option not working for pam_lastlog.so

I'm trying to set up my system to lock out inactive users after 10 days. I'm using CentOS 6.x, and looking at RHEL manual, this is what I found: To lock out an account after 10 days of inactivity, ...
2
votes
0answers
204 views

Ldap client on CoreOS

Has anyone setup ldap on CoreOS before? If so, how does one do such a task? I have a cluster of CoreOS machines and I'm trying to hook up this service Foxpass https://www.foxpass.com/ to it for user ...
0
votes
0answers
30 views

Can't setup mount of EncFS on user login

I've tried to setup EncFS to be mounted on user login as described in this guide excluding the Password Utility section, however it works with little success. The EncFS works properly ...
1
vote
2answers
64 views

Postfix omits realm (@domain) when checking for smtpd pam+mysql authentication

I've trying to configure Postfix so users can send email through SMTP having a username and password. And I'm trying to store credential within a MySQL database. I've taken the path of saslauthd and ...
10
votes
1answer
1k views

Slow ssh login - Activation of org.freedesktop.login1 timed out

On one of my servers I've noticed really delay on SSH logins. Connecting using the ssh -vvv options the delay occurs at debug1: Entering interactive session. extract of connection: debug1: ...
0
votes
1answer
139 views

pam google authenticator can't compute location of secret file

I've installed Google Authentication on all the machines in our system, and while the authentication during login works fine, our machines are producing logs that have this line over and over: ...
0
votes
0answers
82 views

how to get my kvm-nodes monitored by the opennebula-server

I just set up an OpenNebula server with the oned running. I also set up a kvm-node to deploy virtual machines on. When I tried to add the kvm-node to the OpenNebula server with onehost create ...
2
votes
1answer
203 views

cannot login via ssh

Can not login to SLES server via ssh as user1. At the same time I can login as root user without any problem. Authentication method is password based. In /etc/ssh/sshd_config I have ...
0
votes
0answers
107 views

centos7 pam_authz_search for *.group.company.com

Upgrading from Centos6 where we were using ldap.conf entry "pam_check_host_attr=yes" previously, with wildcard 'host' attribute in ldap where the host attribute looked like 'host=*.group.company.com' ...
1
vote
0answers
125 views

SSO Linux and AD Trusted Domain

Having successfully built a one-way trust between 2 AD domains, we can't lookup/id the user in the trusted domain. Here's our use case. AD1: dom1.com (Win2k8 R2) - One-way outgoing trust to AD2 ...
1
vote
2answers
525 views

pam_limits: Operation not permitted for sshd

Debian 8.0, pam 1.1.8-3.1, sshd 1:6.7p1-5. I'm trying to permanently increase the maximum number of open files. In /etc/pam.d/ I've got: /etc/pam.d# grep pam_limits.so * atd:session required ...
1
vote
1answer
43 views

How does pam_limits decide on the default limits?

In a linux system that is using the pam_limits module, but has nothing configured in /etc/security/limits.conf (or /etc/security/limits.d/*) how does pam_limits decided on what limits to implement?
3
votes
1answer
112 views

ssh as user runs program with no authentication (neither password nor keys)

I'd like to set up a user on my system (Ubuntu 14.04 x64) such that people can run ssh example@myhost.example.com and see some output from a program without being prompted for a password or having to ...
1
vote
0answers
58 views

Ubuntu 14.04 “azureuser” exists - and I did not create it

I just logged into an Ubuntu 14.04 instance and in the home folder there is a user "azureuser" (yes, this is an Azure VM) with four items in it: .ssh (folder) .bash_logout (file) .bashrc (file) ...
2
votes
0answers
265 views

LDAP Not working for SSH connections on ubuntu 12.04

Connecting from the client to the server: $ ssh -vvv user@10.0.50.170 OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 debug1: Reading configuration data /etc/ssh_config debug1: /etc/ssh_config line 20: ...