Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
0answers
5 views

How does pam_limits decide on the default limits?

In a linux system that is using the pam_limits module, but has nothing configured in /etc/security/limits.conf (or /etc/security/limits.d/*) how does pam_limits decided on what limits to implement?
3
votes
1answer
82 views

ssh as user runs program with no authentication (neither password nor keys)

I'd like to set up a user on my system (Ubuntu 14.04 x64) such that people can run ssh example@myhost.example.com and see some output from a program without being prompted for a password or having to ...
1
vote
0answers
33 views

Ubuntu 14.04 “azureuser” exists - and I did not create it

I just logged into an Ubuntu 14.04 instance and in the home folder there is a user "azureuser" (yes, this is an Azure VM) with four items in it: .ssh (folder) .bash_logout (file) .bashrc (file) ...
2
votes
0answers
27 views

LDAP Not working for SSH connections on ubuntu 12.04

Connecting from the client to the server: $ ssh -vvv user@10.0.50.170 OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 debug1: Reading configuration data /etc/ssh_config debug1: /etc/ssh_config line 20: ...
3
votes
1answer
56 views

LDAP authentication fails

I try to set up an LDAP directory that will allow me to authenticate Debian users. Once the configuration of the LDAP server and PAM files is done, the authentication fails. I think the client doesn't ...
1
vote
0answers
20 views

The differences between libpam-ldap and libpam-ldapd, included packages and modules? [duplicate]

May I ask what's the differences between libpam-ldap and libpam-ldapd when it comes to included packages and modules? As i understand is nss-pam-ldapd the project of libpam-ldapd, which is an ...
1
vote
0answers
15 views

Remote home-folders with optional but preferred locally-encrypted folder

I have the use case that on default all users are working within remote mounted home directories. However, sometimes they prefer a local home on one or more machines, e.g. because the network is too ...
2
votes
2answers
51 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
2
votes
1answer
29 views

SSHD applying different PAM rules for localhost connections

I am attempting to implement Yubikey auth via SSH. I've edited my /etc/pam.d/sshd file as follows, and it seems to work while connecting locally (ssh user@localhost): #%PAM-1.0 auth required ...
1
vote
0answers
21 views

How to properly automount tmpfs inside encrypted home folder on login?

I have a user with encrypted home folder which is automounted on login with pam_ecryptfs module. I would also like to have several folders automounted as tmpfs using local configuration file from ...
-1
votes
1answer
59 views

Curious what server pam_pwdfile is in var/log/messages

I am getting tons of these messages in my /var/log/messages file Apr 16 06:58:20 server pam_pwdfile[7856]: couldn't open password file /etc/techproxy.shadow Apr 16 06:58:20 server pam_pwdfile[7863]: ...
0
votes
2answers
47 views

Disable ssh login on specified time for particular users

I would like to disable ssh login to my system for particular users say X,and Y on specified time 17.00 to 18.00. so how to achieve this ? any help would be appreciated.
2
votes
1answer
57 views

Is it possible to ignore a missing PAM module?

I am configuring yubico-pam to enable passwordless sudo access using challenge-response from a Yubikey. The following works: # /etc/pam.d/sudo auth sufficient pam_yubico.so ...
0
votes
1answer
25 views

How can I change the directory in wich pam_mkhomedir creates the user's home directories?

I am using pam_mkhomedir to automatically create user's home directories when they first log in. However, the home directories are created inside the /home directory, while i need them to be created ...
0
votes
0answers
22 views

OpenLDAP with GOSA² Host-Authentication (accessTo attribute of User)

i'm having a problem with rebuilding our LDAP in combination with GOSA². We are hosting several linux machines and not all users may have access to all of them. In the past we realized this as a ...
14
votes
2answers
1k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
1
vote
1answer
65 views

Check if account is allowed when using pam_access

I'm using pam_access and /etc/security/access.conf to restrict who can login to my Rhel 6.5 hosts. I have an LDAP server with a diverse user base, and the security people would like a list of who can ...
0
votes
1answer
69 views

migrate samba users to new server

I've read How to migrate Samba User Accounts to a new linux server? however it doesn't address my situation, or at least not with a solution. I have a RHEL 5 machine, wood, running Samba, Dovecot, ...
3
votes
1answer
21 views

Use more complex AND/OR structure with PAM

PAM allows to use sufficent and required for some logic, like auth sufficient pam_a.so auth required pam_b.so auth required pam_c.so which would mean "either a is true, or b must be true and then c ...
0
votes
1answer
104 views

Unable to authenticate LDAP client with PAM when pwdReset = TRUE

I have searched tons of webs and tutorials but I couldn't find an answer to my problem. I have set up OpenLDAP 2.4 on a OpenSUSE 12.3 machine with a password policy overlay. The client is a Linux ...
2
votes
1answer
601 views

Fedora 21 pam_sss authentication failure - permission denied

We have configured a OpenLDAP server which is working fine. FreeBSD, Debian, and a WordPress plugin authenticate with no problems. We are configuring Fedora 21 with pam_sss, but we get the following ...
0
votes
1answer
79 views

tacacs+ for Linux authentication/authorization using pam_tacplus

I am using TACACS+ to authenticate Linux users using pam_tacplus.so PAM module and it works without issues. I have modified the pam_tacplus module to meet some of my custom requirements. I know by ...
1
vote
2answers
116 views

How to filter ldap user logins on linux?

I have several linux servers (ubuntu 12.04) setup to authenticate user logins over an external (to my branch office) LDAP (Novell Edirectory specifically). This is working well, however I am trying to ...
1
vote
1answer
40 views

What's the downside of disabling PAM in OpenSSH if only public-key login is allowed?

/etc/ssh/sshd_config by default has the following line UsePAM yes I read through available documentation and came to the conclusion that PAM is not used if I only use public-key login. What ...
1
vote
1answer
77 views

vsftpd freezes after failed pam_script authentication

I have an Ubuntu 14.04 server with vsftpd and pam_script installed using apt-get. I've configured vsftpd to use pam_script for virtual user authentication and my /etc/pam.d/vsftpd file looks like ...
0
votes
0answers
45 views

ProFTPd won't allow me to log in after password change

I've changed a password for one of my users (using passwd username), and now ProFTPd won't allow that user to log in. Other users can still log in as normal. I'm running Ubuntu 14.04 LTS The error ...
0
votes
1answer
128 views

pam_mount not working when logging in from ssh or console

okay so i configured pam_mount on my centos 6 machine as i did on my centos 7 and 5 machines. But when i login locally or via ssh, pam_mount can't mount my home dir. when i login with a local user, ...
2
votes
1answer
156 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
0
votes
1answer
80 views

How to override a user's UID coming from an LDAP directory?

I am trying to setup Linux logins for users in an LDAP directory. The directory contains users which have a UID under 1000 and I believe this is causing problems with logins to those accounts as UID ...
1
vote
1answer
54 views

Can I configure pam_ldap without configuring nss?

On my servers I have my system users provisioned with Chef and have no desire to expose any additional users to these machines. I would however like to utilize pam for the authentication backend for ...
2
votes
2answers
139 views

Debugging a Postfix Saslauthd PAM-PGsql authentication failure

I've set up pam-pgsql to lookup passwords in my database for Postfix via Saslauthd. I can test credentials using the command line: $ sudo testsaslauthd -u user@email.com -p password 0: NO ...
0
votes
2answers
253 views

sendmail & sasl auth on CentOS 6

I'm moving a mail server from one CentOS 6 to another. I use sendmail with sasl pam authentication. When I try to send mail it fails because the user is not authenticated and the mail client does not ...
1
vote
2answers
628 views

Join Red Hat Linux 6 to a Windows Active Directory Domain

I am using Red Hat 6 (for testing purpose) and configure samba with active directory.Red Hat 6 has successfully join with my windows server 2003 domain. By typing the command [root@mainserver /] # ...
0
votes
1answer
157 views

pam_mount on centos won't mount cifs

so I have this problem that pam_mount won't mount my cifs home dirs pam_mount has this in /var/log/messages: Feb 3 15:49:18 centosy nslcd[1278]: [3c9869] <passwd="tomas"> (re)loading ...
0
votes
2answers
76 views

Linux smart card authentication

I am using puttysc to authenticate to a remote Linux server with my smart card . But as I understand, this isn't true PKI authentication - puttysc just unlocks the public key and matches it to a user ...
2
votes
1answer
71 views

fail2ban did not ban anything, regardless of the settings

this is the first time that i did not find a solution here. so, hopefully it can be solved. i've installed a fresh, new ubuntu minimal system (14.04) with ssh on it. Right after that i installed ...
0
votes
0answers
101 views

pam_tally is not supporting user locking after failed attempts on CentOS

After adding the below configurations in /etc/pam.d/system-auth. The user account is not getting locked after multiple failed attempts. As per the below configuration the account should be locked ...
1
vote
2answers
81 views

Configuring PAM with Augeas

I am attempting to use Augeas to configure the files in my /etc/pam.d directory in a default Ubuntu 14.04 install. My goal is to find all nodes that have an argument of either 'nullok' or ...
12
votes
1answer
421 views

What do the OS X authorization mechanisms actually do?

Background  I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On. Please do correct me if I'm wrong, but I believe ...
2
votes
4answers
439 views

PAM, RADIUS, Google Authenticator and Two Factor Auth

I have setup FreeRADIUS, PAM and the Google Authtenicator. FreeRADIUS calls PAM, which in turn calls the Google pam_google_authenticator.so libary. That all works successfully. However, that's not ...
1
vote
2answers
230 views

Sending automatic mail on ssh-login fails

I'm trying to let my server send me automatically an email on ssh-login. What I've done: Created a login-notify.sh file (user root, group root, chmod 755) and placed it inside /etc/ssh/ #!/bin/sh ...
0
votes
0answers
82 views

Postgres on OpenSuse doesn't start after update

I tried to upgrade OpenSuse from 12.1 to 13.1 and after 'zypper update' and reboot Postgresql doesn't start. Here is the output of service postgresgl status: postgresql.service - LSB: Start the ...
0
votes
1answer
297 views

imapd-ssl: admin: No such file or directory

I am trying to set up my VPS so I can use Thunderbird IMAP to manage my mails. First, I installed postfix and followed this guide to create an SSL certificate. Then I installed sasl2-bin and ...
4
votes
1answer
147 views

Practical ulimits

One of the projects I'm working on is moving certain puppet-applied ulimit settings away from "that sounds about right" to dynamically allocated based on the environment. This is for ...
1
vote
0answers
49 views

pwauth kerberos authentication specifying default and secondary servers

I am currently using Kerberos authentication for Basic Authentication on Apache using pwauth and mod_auth_external. I would like to add multiple servers to authenticate from, however they would have ...
-2
votes
2answers
94 views

How do PAM advanced options work, exactly?

I've been reading everything I can find on PAM (e.g. http://wpollock.com/AUnix2/PAM-Help.htm), however I'm still confused about how precisely the advanced options are supposed to work. For example, ...
1
vote
0answers
443 views

Ubuntu server + Samba + PAM + Apple OpenDirectory

Due to various reasons, we are looking to migrate our file servers from OS X Server 10.9 over to a true Samba implementation running on Ubuntu 14.04LTS. We have Ubuntu up and running with Samba ...
0
votes
1answer
68 views

Chrooted user logged out immediately after login

I am trying to use chroot to setup a user who can login via ssh and limit access to the /var/www directory. The server is on AWS running Amazon Linux 64-bit, openssh installed. I used ssh-keygen to ...
0
votes
1answer
266 views

su: Authentication failure

I have Ubuntu 14.04 server on which I can't use anything that relies on su. This manifests in inability to restart services or even switch users. root@ci-web1:~# su - mxx su: Authentication failure ...
2
votes
1answer
5k views

LDAP authentication on CentOS 7

After upgrading to CentOS 7 it's no longer possible to login via LDAP. With CentOS 6 I used the package pam_ldap which worked fine, but now pam_ldap is no longer available for the new version of ...