Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
0
votes
2answers
24 views
Locking a user's account locally when kerberos is enabled
I'm trying to set up Chef-managed accounts for a group of machines with the following characteristics:
If there is no local account, login is blocked.
If there is a local account with SSH keys, use ...
0
votes
0answers
37 views
How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?
Fail2Ban on Ubuntu 10.04
Configuration files
/etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1
bantime = 10 # made for test purposes
maxretry = 3
backend = polling
destemail = ...
0
votes
0answers
26 views
Including pending update list in motd [migrated]
How would you include the list and / or count of pending updates in the welcome banner?
Eg.
username: User
password: *****
Hi 'User', welcome on 'localhost'
There are 8 pending updates, you need to ...
-2
votes
0answers
26 views
Linux mail server allowing users access by windows clients without entering password [closed]
I have long been trying to solve a problem but I could not.
I want to install a linux mail server allowing users access by by windows clients without entering password.
I tried with a combination of ...
3
votes
1answer
41 views
What does this plugable authentication module (PAM) “code” mean?
I am reading a configuration file for Linux PAM and am wondering what it means:
auth [success=2 default=ignore] pam_krb5.so minimum_uid=1000
I understand that "auth" means this rule is ...
0
votes
1answer
26 views
Kerberos pre-authentication failed on nfs mount
I have the following nfs export:
/home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534)
When trying to mount that on a client I get:
client:/home # ...
0
votes
0answers
19 views
Samba4 compiled from source alongside winbind repo package, not working with PAM
I am on Linux Mint. I have compiled and installed Samba4 from source and joined a Samba4 DC I have elsewhere on my network. I have also been trying to get Samba/winbind to work with PAM to ...
-1
votes
0answers
15 views
How do I make a pam configuration to test that the account exists and ignore wrong or null password?
I got the configuration for this from the same site...
auth sufficient pam_permit.so
But it doesn't work if user gives empty or null password.
Can you please let me know what should be the ...
0
votes
1answer
35 views
PAM configuration for MSCHAP for radius/tacacs
I would like to know how to enable MSCHAP for radius or tacacs.
Please help.
0
votes
0answers
20 views
Dell OMSA Authentication Fail on Ubuntu
I am trying to log into an install of Dell OMSA 5 on a Dell PowerEdge 2850 running Ubuntu 8.04 LTS x64.
OMSA is 32bit and is trying to load the 64bit pam modules for authentication. Whatever ...
0
votes
0answers
13 views
PAM authentication: external falling back to internal
I am trying to configure PAM authentication in a linux box with an external provider falling back to internal when it is not available.
I query the external provider using a custom script via the ...
0
votes
1answer
75 views
Account lockout setting in Centos 6
I'm trying to implement an account lockout after 3 fail sign-on attempt. Root is exempted.
Here's what I have in my /etc/pam.d/system-auth file so far
auth required pam_tally2.so deny=3 ...
2
votes
1answer
127 views
vsftpd - PAM - MySQL and pam_mkhomedir to create directories
I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection.
Here is ...
1
vote
0answers
16 views
Set pam_unix password without knowing current password, having authenticated with pam_winbind
Right, so I have winbind authentication set up for login. However, I think there may still be some situations in which it would be useful for the user to be able to set their unix password (in the ...
0
votes
1answer
53 views
Lag between PAM password acceptance and session open on CentOS5
I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
0
votes
0answers
140 views
MySQL/SASLAuthd/Postfix authentication issue
Can't seem to get authentication via Mysql with SASLAuthd with postfix working. Dovecot connects to mysql by itself fine, and connections/queries show up in /var/log/mysql/mysql.log. When connecting ...
0
votes
1answer
63 views
restarting authconfig changes order of my /etc/nsswitch.conf
Here is my nsswitch.conf:
passwd: files ldap sss
shadow: files ldap sss
group: files sss
When I restart authconfig, it removes ldap from passwd, shadow, and group.
Here's my ...
0
votes
2answers
29 views
changing /etc/pam.d location
is there a way to change location of /etc/pam.d directory, or is it hardcoded into PAM?
can't it be changed with some environment variable for specific client programs?
for example:
...
0
votes
1answer
167 views
getent and ldapsearch results are inconsistent concerning the loginShell
I have a test that creates a user in LDAP with /bin/bash and I then modify the ldap attributes to /bin/noshell but the results from getent and ldapsearch are inconsistent for the shell.
This user does ...
1
vote
1answer
119 views
Restricting LDAP users from authenticating without a valid shell
What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
0
votes
2answers
59 views
Requiring two-factor ssh authentication only from certain clients
I am about to make two-factor authentication mandatory for ssh logins using libpam_google_authenticator. I'd like to be able to waive this requirement when users log in from certain IP addresses.
...
1
vote
1answer
137 views
Linux PAM pam_succeed_if.so
I've specified an AD security group in PAM to restrict which domain users can login. I've also restricted sessions for AD users to this group. This prevents a logged in user from doing an "su -" to ...
0
votes
2answers
240 views
sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?
OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008
selinux-policy-2.4.6-338.el5
pam-0.99.6.2-12.el5
SELinux is running in permissive mode:
# sestatus
SELinux status: enabled
...
0
votes
1answer
47 views
Can I setup a Samba master password?
I want to be able to connect to a Samba share as a specific user but I don't know his password, and I don't want to change it.
I did this on Dovecot by setting up a master password, can I do something ...
0
votes
2answers
71 views
Can't get pam_time.so to work with http
The /etc/security/time.conf man page contains this example:
All users except for root are denied access to console-login at all times:
login ; tty* & !ttyp* ; !root ; !Al0000-2400
For this ...
0
votes
1answer
38 views
Call Pam module before public key authentication on SSH
I am currently writing a pam module which does some checks if the key stored in authorized_keys is still valid. However I cant find a possiblity to run the module before the public key authentication ...
2
votes
0answers
334 views
Linux samba server: cifs_mount failed w/return code = -12
Server: RHEL 5.9 / smbd 3.0.33
- Clients: various, though all were using current mount.cifs (5.2)
I already solved this problem, but it was such a nightmare to hunt down these error codes I felt like ...
0
votes
1answer
68 views
When changing passwords, how to let one PAM module check for old passwords and another to save new ones?
Our server is currently using the blowfish cipher to store passwords and it uses pam_unix2. We'd like to gradually switch to SHA. The idea is that all newly changed passwords would be hashed with SHA. ...
0
votes
0answers
78 views
OpenVPN + PAM + Keberos + AD + Domain shares
I would like to ask if someone the setup mentioned in the title already set up?
I have a domain with serval DC's, fileservers, etc. At the moment I set up the OpenVPN server as domain member and use ...
2
votes
1answer
37 views
configuring pam with flat files backend
I would like to configure pam module to use flat files for authentication. Basically I need same thing like pam_unix just with possibility to use different files (other than /etc/passwd and ...
0
votes
0answers
70 views
PAM error on reboot of the RADIUS client
I have a debian squeeze machine that acts as RADIUS client talking with the Freeradius server. I have configured PAM on the client, so made following changes.
Added radiusd to /etc/pam.d which ...
0
votes
0answers
152 views
PAM unable to dlopen() failed to map segment from shared object: Cannot allocate memory
i was going to configure the system to enable mysql auth through PAM while i saw the following error on /var/log/auth.log:
PAM unable to dlopen(pam_ck_connector.so): ...
0
votes
0answers
238 views
Why would Dovecot POP3 and IMAP Authentication from external IP address stop working?
Over a year ago I setup a Dovecot 1.2.9 POP3/IMAP server (which works alongside a Postfix SMTP server) with PAM authentication. This has been operating (I believe) without incident until recently ...
0
votes
0answers
19 views
I'm getting invalid argument (22) when pam_abl is ran
I'm running Arch Linux with pam_abl version 0.5.0-3. So far it has been working well, and it seems as if it is still working, but when I look at the auth.log this is what an invalid authentication ...
0
votes
2answers
120 views
validate only one user with pam ldap and nslcd
I want only user "theuser" to login to this host.
I have tried the following in nslcd.conf:
pam_authz_search (&(objectClass=posixAccount)(IsActive=TRUE)(uid=theuser))
but all can login. If ...
1
vote
1answer
127 views
Postfix smtpd won't talk to saslauthd
I have an saslauthd setup to authenticate against PAM. It seems to do its stuff:
root@sasltest:~# testsaslauthd -u quest -p #### -s smtp
0: OK "Success."
I have libsasl 2.1.23, postfix 2.7.1.
I ...
1
vote
1answer
203 views
Ubuntu 12.10 - Can't find my logs
Up until few days ago, my Ubuntu 10.04 worked like a clock.
Then I switched to Ubuntu 12.10 and things don't work the same way with this setup. First, the new system wasn't logging any mail activity, ...
3
votes
1answer
45 views
sudo failing even though ownership and modes set correctly
I am getting the dreaded sudo: must be setuid root error even though the executable in /usr/bin/sudo has ownership root:root and mode 4755 (-rwsr-xr-x). /etc/sudoers is mode 440. My user is in sudoers ...
1
vote
0answers
83 views
pam_mysql / vsftpd error 'AUTHENTICATION FALURE (FIRST_PASS)'
I setup vsftpd and mysql auth via pam on Debian Squeeze.
Config:
auth required pam_mysql.so user=server passwd=x host=localhost db=server table=ftp usercolumn=username passwdcolumn=password ...
1
vote
4answers
108 views
PAM LDAP authentication restriction
I have integrated PAM with LDAP authentication. Q- how to restrict login for some users to some Linux servers.
For example- we have integrated 100 Linux servers in the Org with PAM LDAP auth and we ...
0
votes
1answer
64 views
MariaDB + PAM: Is Remote Auth Secure?
I have a MariaDB instance which is using PAM to auth against Active Directory. Is remote authentication with this service secure? I ran a Wireshark trace during the auth process, and passwords are not ...
2
votes
2answers
110 views
edit crontab for apache
I am transfering crontabs from an old server (centos 5.5) to a a new (centos 6.0) and there is a problem with (the most important) user apache. On the new server I am getting the following:
...
2
votes
1answer
158 views
Can I use DenyHosts for a SMTP service
I would like to block some hosts that are brute forcing my SMTP server.
I'm currently using DenyHosts for SSHD and was wondering if I can add the SMTP service too.
It could be possible based on this ...
2
votes
1answer
103 views
Authenticate Git virtual users via PAM
Can Git authenticate virtual users via PAM? In particular, would Git require some additional utility, such as gitolite or gitosis?
2
votes
2answers
219 views
How to increase max FD limit for a daemon process running under a headless user?
To increase the FD limit for a daemon process running under a headless user on a Ubuntu Linux machine we did following changes in /etc/security/limits.conf
soft nofile 10000
hard nofile 10000
We ...
0
votes
0answers
34 views
pam_abl with ChallengeResponseAuthentication
Is there any chance to get pam_abl working with sshd's ChallengeResponseAuthentication?
With
ChallengeResponseAuthentication yes
PasswordAuthentication yes
I get
$ ssh myserver
Password:
...
2
votes
1answer
479 views
Ubuntu 12.04 updates broke VSFTP
I am running Ubuntu 12.04 LTS. I did some minor updates using apt.
After rebooting vsftp stopped accepting connections system user logins. In the auth log I am getting the following errors
Dec 22 ...
2
votes
1answer
261 views
pam_tally2 or pam_faillock account lockout with ssh
I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local.
I need to lock users out after N failed password logins.
The examples in ...
1
vote
1answer
173 views
Whitelist IP from google-authenticator in sshd pam
My Ubuntu 12.04 server uses the google-authenticator pam module to provide two step authentication for ssh. I need to make it so that a certain IP does not need to type the verification code.
The ...
3
votes
4answers
352 views
How to grant su access without password to one user only in wheel group (FreeBSD)?
I know how to enable su without a password for all wheel group users by adding the appropriate configuration line in /etc/pam.d/su.
I do not want to enable this for all wheel users but only one ...
