Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
0answers
5 views

Mounting samba directory changes all file permissions to user who mounted it

I have a xubuntu 14.04 client, a debian 8 Samba File server and an external Active Directory service. I log in as user1 on the client authenticating against the ADS with winbind. My home directory ...
0
votes
0answers
5 views

Dovecot auth-worker permission denied to PAM and even /dev/log

Problem I have a problem dovecot authenticating users via pam_sss.so (in an LXC container, which may be related or may be not). # doveadm auth login semenov Password: passdb: semenov auth failed ...
0
votes
1answer
23 views

how to control ldap users access using groupdn?

i am using openldap, nslcd and nss-pam-ldapd. i want to restrict users login to ldap client. i have configured this in centos6.5 without any problem using groupdn. but in centos 7, there is no ...
1
vote
2answers
22 views

Initialise Kerberos ticket on ssh login using PAM

Right, so I am struggling a bit with PAM in Centos7. I have no idea how to configure it manually and make the changes permanent so that I get a kerberos ticket after a successful ssh login. The ...
6
votes
3answers
144 views

Conflicts with PAM configuration files when upgrading system

I have a VPS that runs Ubuntu 14.04.4 LTS; it was installed as a whole with Plesk by OVH. I juste did a apt-get upgrade, and at some point I had a message regarding PAM. The system is in French, but ...
-1
votes
0answers
20 views

Kerberos-based SSH login requires local user account

I've recently set up a linux system (Debian-Jesse) which has joined an MS-Based Kerberos domain and been set up to allow Kerberos-based authentication for remote access. The only issue is, ...
-1
votes
1answer
30 views

root login at console just gets “Login incorrect” no password prompt

I have a Debian 8 server. Root login at console just gets "Login incorrect" with no password prompt. I can login with root through ssh just fine. I can login into the console with another user and su ...
1
vote
1answer
36 views

How to config vsftpd to map virtual user to a custom local user?

I would like that virtual user use a defined local user. this local user is member of groups apache (www-data for debian user, I use here a centos7) and ftp useradd ftpuser -d /var/www -g apache -G ...
0
votes
1answer
30 views

what does “-session …” mean in /etc/pam.d/system-session?

In Red Hat 7 I see -session optional pam_systemd.so in /etc/pam.d/system-session. I also see that the - prefix is mentioned in LFS docs: ...
2
votes
0answers
46 views

X11rdp/xrdp with aad-login -> pam authentication fails (xrdp_mm_process_login_response: login failed)

We are implementing a solution that allows users to login via aad-login (Azure Active Directory login) following this guide: https://github.com/bureado/aad-login Everything works fine - I can login ...
0
votes
3answers
82 views

openvpn pam authentication failure

I am trying to setup PAM authentication on my openVPN instance running on Ubuntu Server 15.04 but i keep getting an authentication failed error, am i missing anything? server.conf port 1194 proto ...
1
vote
1answer
33 views

PAM authentication - Write error: broken pipe

In order to allow the 2FA in my domain, I setup a LinOTP server to manage the map between tokens and users (from LDAP) in my realm. So, I configured the PAM stack to integrate this authentication ...
0
votes
1answer
16 views

Nonsystem authentication for unprivileged sftpd

I am creating a test system that needs to be able to briefly act as a sftp server on a nonprivalaged port. The test system runs as a normal user. So I'm thinking as running sshd with the sftp ...
1
vote
1answer
21 views

Local credentials used when radius server is available sshd pam_radius

I have pam_radius setup and it works (centos6, pam_radius: 1.4.0-2.el6), i can authenticate via the radius server using ssh. What i am trying to accomplish is that when the radius server is ...
0
votes
0answers
16 views

Linux Samba Server: PAM?

I've read several places that the Linux Samba server cannot use PAM authentication - some say because of the challenge-response pattern and other say because it requires unencrypted passwords. ...
0
votes
0answers
36 views

pam_sss(sudo:auth): authentication failure

I'm having some CentOS 7 machines joined a windows domain with the following steps: #yum -y install realmd sssd oddjob oddjob-mkhomedir adcli samba-common #nmcli c modify eth0 ipv4.dns 192.168.3.18 ...
0
votes
1answer
47 views

Trying to execute a script with pam authentication

I want to be able to execute a custom script when pam does the authentication but I get an error out that I can't seem to pass: Feb 20 17:39:47 DC03R07DS25-08 sockd[2874]: pam_exec(sockd:auth): send ...
0
votes
0answers
25 views

do not allow multiple sessions if user have different IPs

I am running Red Hat Enterprise Linux 6.6 and for authentication we use LDAP authentication. We have running application on a server (doesn't really matter which one it is) and the way application ...
2
votes
0answers
84 views

Monitoring failed ssh logins with pam and bash?

I modified /etc/pam.d/common-auth to run a bash script when a login fails or when a login is successful and it works for successful logins but not failed login attempts when trying to ssh. Once I am ...
0
votes
1answer
26 views

configure a PAM module to be required for all but certain users for which it should be sufficient [duplicate]

I'd like to be able to configure /etc/pam.d/sshd so that: for all users except those in group "admin", module pam_radius is required. for those users in group admin, module pam_radius is ...
1
vote
1answer
25 views

Detect SSSD authenticating domain programmatically in multi-domain environment

We have some servers in a mixed RH5/RH6 enthat need to authenticate to one of two LDAP services. This is implemented in SSSD and is running fine. Users from either domain can login successfully and ...
2
votes
0answers
221 views

Mac OSX - SSHD partially broken after El Capitan Upgrade

I recently upgraded my firm's Mac Mini device to El Capitan from Yosemite, and encountered several issues during the upgrade. I've gotten most of them resolved but one that's still failing is the SSH ...
0
votes
1answer
22 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...
1
vote
1answer
61 views

OpenSSH use (public key or password) + google authenticator

I want to allow these two authentication types: public key + google authenticator OR password + google authenticator. I have the following in my sshd_config: AuthenticationMethods ...
0
votes
0answers
13 views

ocredit ignored in PAM config

oscap is reporting that ocredit requirements are not being met. Current system-auth config: auth required pam_env.so auth sufficient pam_unix.so nullok try_first_pass auth ...
2
votes
1answer
40 views

Security implications when only allowing logins via key and UsePAM setting is 'yes'?

When setting up a new server, I generally want to allow logins only via key authentification and not from the root user. Therefore, I edit the sshd_config like this: I change 'PermitRootLogin' to ...
0
votes
1answer
23 views

ldap-overlay with fixed default attributes

i'm having a largish user-base (>>1000) which should be able to collectively use some sharing service. the user base is slowly but constantly changing. esp. we are not interested in privilege ...
0
votes
2answers
46 views

pam_groupdn doesn't work at all. always all users allowed to log in

i have tried to install pam, ldap on fedora23. i have configured pam.d/system-auth as follows: #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time ...
1
vote
0answers
24 views

how to configure freeradius for separate Code and Password prompts, instead of a single Password prompt?

I've got a Freeradius server set up where the users in /etc/freeradius/users have Auth-Type := PAM. This makes radius refer to the /etc/pam.d/radiusd file, and in this file I have auth requisite ...
0
votes
0answers
48 views

Webmin authentication against LDAP

I want ultimately to authenticate Webmin user against one LDAP. I have read the page How can I make a Webmin user always use the same password as Unix?. According to this explanation, the ...
1
vote
1answer
27 views

Howto setup LDAP/Linux so when a user is deleted, its bash user session is immediately closed

Is there a way to setup OpenLDAP on a Linux (Redhat/CentOS) system so that when a user is removed from the LDAP server or he/she is removed from the "login is authorized" group, all his/her open ...
6
votes
1answer
131 views

Is it possible to use Kerberos over TLS through sssd?

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with Kerberos and ...
4
votes
2answers
154 views

AWS Simple AD: “KDC has no support for encryption type” for users created with adtool, but not with MS Management Console

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with kerberos and ...
2
votes
1answer
65 views

SSH, Kerberos, AD: how / where to config /etc/pam.d/password-auth?

I have a CentOS 6 machine here and want to give SSH access for users from another forest, which is trusted. I got a temporary workaround, which is: 1) change content in /etc/pam.d/vncserver to auth ...
2
votes
1answer
52 views

OpenLDAP - How to restrict Debian login to specific groups (posixGroup)?

I'm trying to restrict login to specific LDAP groups in Debian 8. The system is configured to use OpenLDAP (PAM) as authentication method. My goal is to configure the system to allow all local users ...
0
votes
0answers
69 views

Problems using SSH with winbind authentication

I am trying to set up authentication against an Active Directory Server on a Debian Wheezy machine. So far, getent passwd/group works perfectly and shows me the network users/groups. wbinfo -u/-g ...
0
votes
2answers
171 views

login with active directory users on debian jessy not working

I'm trying to get the login with active directory users working for nearly a week now. First of all, I'm pretty new to pam, samba, kerberos and winbind. We worked with local users and sudo before, but ...
6
votes
2answers
185 views

Unable to login via PAM and ldap: failed to get password

I'm trying to have OpenVPN authenticate users via PAM over LDAP to an Active Directory server. Here are the relevant parts of my configuration files: /etc/openvpn/server.conf: # ... plugin ...
0
votes
1answer
61 views

Authentication based on any of the PAM module

I want to allow some users to only use SFTP but not SSH. Also I dont want these SFTP users ID and password to be stored in /etc/passwd file. I want their id and password details will be stored in a ...
3
votes
1answer
49 views

Kerberos authentication fails when local password is expired

I am using pam_krb5 with local accounts (Linux) for AD password authentication. Things are working great, users are able to authenticate with both AD and local passwords. I am having a problem ...
0
votes
0answers
80 views

How to set up libreswan with PAM and Google-authenticator for Mac Clients

I can't seem to get xauthby=pam working. I recompiled libreswan with PAM support. The VPN server does work when I set it up to use chap so I know the server is largely set up right. I'm following ...
1
vote
1answer
96 views

PAM with LDAP and add an exception for local user

I've successfully configured LDAP and SSH. Also I've added a requirement that user should be in admin group. That works. /etc/ldap.conf ... pam_groupdn cn=admin,ou=Groups,dc=example,dc=com ... ...
0
votes
1answer
81 views

SSH/SFTP to Centos 7 from Coda

I am running a droplet on DO with Centos 7 - from my mac terminal I can login as root (with password) without any problems. But if I try the same from Coda (editor) I run into problems. My audit log ...
1
vote
0answers
234 views

How to use SHA-256 hashed (and salted) passwords from OpenLDAP in pam_ldap?

I have hashed and salted passwords in OpenLDAP for login via PAM in Linux. The setup works when the hashes are of type SHA-1 (salted or unsalted) or plain text. In these cases everything works fine ...
0
votes
0answers
91 views

CentOS7 ldap client not authenticating with ldap server

I am using ApacheDS which was a breeze to setup thanks to the apacheds mailing list. I am able to retrieve ldapsearch results, however, I am not able to get anything by doing a:"getent passwd ". ...
0
votes
0answers
77 views

PAM - Ignore local user, if LDAP-connection works

I have configured some SLED10SP1 (not allowed to update) machines to use LDAP for user authentication. Because SLED10 doesn't have official packages for pam_ccreds or sssd, I have to find a way to ...
1
vote
1answer
285 views

SSH Authentication using RADIUS + Google Authenticator

I'm trying configure my SSHD's to authenticate users using FreeRadius. The FreeRadius server needs to first require a valid OTP using Google Authenticator, and then verify the system account password. ...
0
votes
0answers
57 views

pam_access nisnetgroup with nested posixgroup

We have pam_access enabled and correctly allowed/denying users based on the rules in place. One such rule looks up LDAP backed NIS groups + : @hostname-granted : ALL Putting tuples in ldap work for ...
5
votes
5answers
186 views

Filter LDAP user through PAM so it appears to not exist at all

In our corporate environment long ago some wiz decided to put the user "mysql" into LDAP. The account is disabled: $ sudo su - mysql This account is currently not available. ...but it's id still ...
1
vote
0answers
84 views

PAM Google Authenticator With SFTP And Other Apps

I'm attempting to set up a situation where SSH Authorized Key + Google Authenticator Code is sufficient to ssh into the server. This is working fine for normal SSH terminal operations - I'm prompted ...