Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
0answers
7 views

Unable to authenticate with PAM under non-root user

I am trying to build an application on a CentOS 7 server that needs to authenticate against PAM. The application is Python-based, so I have integrated python-pam into the project. The application ...
0
votes
0answers
11 views

SLES12, Authentication with PAM and LDAP

I want to set up an ssh-server which can authenticate against a ldap-server. The ldap-server is already running (openldap). Now I've installed a fresh SLES12SP1-Server and followed some tutorials for ...
4
votes
0answers
25 views

How to set-up google-authenticator and set specific match rules to allow different login rules?

I'm trying to set Google-Authenticator (google 2 factor authentication). The relevant files are: [root@srv01 ~]# cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_google_authenticator.so auth ...
0
votes
0answers
10 views

How to limit number logins with su using pam_limits

I have configured the /etc/security/limits.conf to have the below line: testuser hard maxlogins 1 I have tried to ssh to the system from that user, and its blocked me the second time... ...
2
votes
1answer
36 views

SUDO Keeps promting for password, when using SSSD with AD

Hi I am trying to setup SSSD to authenticate to AD on RHEL. I able able to login with my AD user and password and see my groups when I run id. But when I try to use sudo, it just keeps prompting for ...
1
vote
1answer
33 views

OpenLDAP client inside a docker container

I have a docker container running CentOS 6 with a non-root user and OpenLDAP. When I use getent passwd it just returns the data from /etc/passwd. The config file /etc/nsswitch.conf is customized ...
2
votes
0answers
57 views

LDAP changing password for wrong user?

I have an OpenLDAP server setup. I currently have two users added to my server. As far as my testing goes, a single user instance work just perfectly. My first issue arise when i have two users on the ...
0
votes
1answer
19 views

LDAP SSH + PubKey auth Fallback

I have followed this guide here : https://github.com/jirutka/ssh-ldap-pubkey In order to setup a LDAP server that allows authentication requesting both Password and Public Key in order to login. Now ...
0
votes
1answer
27 views

Ssh + ldap not asking for private/public key

I have fully configured a LDAP server which works perfectly for authenticating users across my multiple nodes. I wanted to add an extra layer of security with the usual two factor public private key. ...
0
votes
0answers
13 views

Restrict access to Linux via PAM with configured SSO

i have SLES 12 in Active Directory Domain. Single Sign On for SSH is configured. I want to allow access to server only to some AD groups via PAM (not only for SSH Service, ftp, etc.). I tried to add ...
0
votes
0answers
16 views

OpenVPN authentication using pam_winbind

I'm running an OpenVPN Server on a Debian machine joined to my Active Directory Domain. I'd like to use pam_winbind for VPN authentication. This is where the troubles arise. Authentication is working ...
0
votes
0answers
12 views

Force nproc ulimit on non interactive user

I have a script that can be launched n times at the same time through php-fpm. php-fpm pool is set to run under a certain username and I want to limit the number of processes this username can launch. ...
0
votes
1answer
13 views

changing where pam_mkhomedir makes a directory

I want to create user directories for an LDAP user (389-ds) If they don't exist so I am using pam_mkhomedir . How do I create these directories on a different mount point say /nfs/home instead . I ...
0
votes
1answer
15 views

SunLDAP Schema Extensions to support Linux/Unix Authentication + Sudo

We are running SunLDAP (Sun/Oracle Directory server 11), and would like our Linux/Unix machines to authenticate against LDAP and also use LDAP for storing SUDO policies. What Schema Extensions are ...
0
votes
0answers
36 views

PAM understanding use_first_pass

In PAM modules like pam_unix.so, the manual describes the difference between use_first_pass and try_first_pass. However, i wanted to test that with the passwd command (Changing the password for a user)...
0
votes
0answers
21 views

Winbind locks up useradd and userdel

Running userdel or useradd locks up on one of our AD-connected Debian 8 machines. ┌[root][machine]:/ └$ useradd -p "superdupersecret" peter While this command is blocking one can observe how ...
1
vote
0answers
25 views

PAM+LDAP no longer working after SLES 10.4->11.4 Upgrade

authentication via LDAP has ceased functioning after we upgraded to SLES 11.4 via recommended method (boot from DVD). Unfortunately with SLES I cannot give you any meaningful log output since neither ...
1
vote
0answers
35 views

Domain User home directory upon first login

I'm having some trouble setting up default files in the user home directory. The setup is a Centos 7, and I've successfully let it join the company's domain and authenticate through our AD. I'm able ...
0
votes
1answer
41 views

Server allows logging in without supplying a password and no ssh keys were exchanged, what could be the reason?

I'm trying to secure an outbound server with Google 2FA solution. For the time being, I'm first configuring everything on a local Vagrant machine and once everything works as intended I'll run it as ...
1
vote
0answers
23 views

libnss-ldapd and Onelogin vLDAP

I'm trying to get Onelogin's new vLDAP service working with libnss-ldapd on an Ubuntu server (14.04). It looks like vLDAP uses authenticated bind per user. I've tried lots of different configurations ...
1
vote
1answer
32 views

How to configure pam sshd to allow different rules on different users/groups?

I'm configuring google two-factor authentication on an outbound server in the company I work for. Here are the relevant configurations: /etc/ssh/sshd_config: ubuntu@stage-itai-1:~$ egrep -v '^#' /...
1
vote
1answer
52 views

How to use the ssh server with PAM but disallow password auth?

Many tutorials tell you to config your ssh server like this: ChallengeResponseAuthentication no PasswordAuthentication no UsePAM no but with this setup you cannot use PAM, as i plan to use 2 ...
5
votes
1answer
176 views

SSH works with expired Kerberos Password

I have setup SSH - single sign on using kerberos V5. When a user password has expired , it returns 'Warning: password has expired.' and allows the user to login! I even made changes in the /etc/pam.d/...
1
vote
1answer
57 views

How to only allow users and/or groups access to certain client machines that are connected to an openldap server?

I would really like to figure out how I can allow users and/or groups access to certain client machines that are all connected to an OpenLDAP server. I would like to do this whether the user is ...
2
votes
0answers
25 views

PAM vs /etc/shadow in Dovecot SASL configuration - Security differences?

I set up a server with Postfix SMTP auth through Dovecot SASL. However, it was not possible to get the PAM authentification working as standard out of the box. So more by chance, I changed it to ...
0
votes
1answer
52 views

How can I allow all users to run mount as root?

How can I allow all users to run mount as root? I know there's a lot of solutions out there recommending the following edit, but it's not working for me. I've edited /etc/sudoers to include: ALL ...
4
votes
1answer
64 views

openldap user can't login when using tcsh

I would appreciate any help in the following problem: I have an openladp (2.3.39) server (Fedora 8) which authenticates users from other ldap clients (various versions of Fedora). On my attempt to ...
0
votes
1answer
25 views

How can I ensure auditability and least privilege based on AWS users inside an EC2 image?

I'm interning at a company which runs in an AWS environment and is starting to look into locking down user privileges, so I'm looking into ways to secure EC2 instances. Specifically, I want to find a ...
0
votes
0answers
41 views

Mounting samba directory changes all file permissions to user who mounted it

I have a xubuntu 14.04 client, a debian 8 Samba File server and an external Active Directory service. I log in as user1 on the client authenticating against the ADS with winbind. My home directory /...
0
votes
0answers
46 views

Dovecot auth-worker permission denied to PAM and even /dev/log

Problem I have a problem dovecot authenticating users via pam_sss.so (in an LXC container, which may be related or may be not). # doveadm auth login semenov Password: passdb: semenov auth failed ...
0
votes
1answer
114 views

how to control ldap users access using groupdn?

i am using openldap, nslcd and nss-pam-ldapd. i want to restrict users login to ldap client. i have configured this in centos6.5 without any problem using groupdn. but in centos 7, there is no ...
1
vote
2answers
56 views

Initialise Kerberos ticket on ssh login using PAM

Right, so I am struggling a bit with PAM in Centos7. I have no idea how to configure it manually and make the changes permanent so that I get a kerberos ticket after a successful ssh login. The ...
6
votes
3answers
352 views

Conflicts with PAM configuration files when upgrading system

I have a VPS that runs Ubuntu 14.04.4 LTS; it was installed as a whole with Plesk by OVH. I juste did a apt-get upgrade, and at some point I had a message regarding PAM. The system is in French, but ...
0
votes
0answers
49 views

Kerberos-based SSH login requires local user account

I've recently set up a linux system (Debian-Jesse) which has joined an MS-Based Kerberos domain and been set up to allow Kerberos-based authentication for remote access. The only issue is, ...
1
vote
1answer
152 views

How to config vsftpd to map virtual user to a custom local user?

I would like that virtual user use a defined local user. this local user is member of groups apache (www-data for debian user, I use here a centos7) and ftp useradd ftpuser -d /var/www -g apache -G ...
0
votes
1answer
39 views

what does “-session …” mean in /etc/pam.d/system-session?

In Red Hat 7 I see -session optional pam_systemd.so in /etc/pam.d/system-session. I also see that the - prefix is mentioned in LFS docs: http://www.linuxfromscratch.org/blfs/view/7.6-systemd/...
2
votes
0answers
91 views

X11rdp/xrdp with aad-login -> pam authentication fails (xrdp_mm_process_login_response: login failed)

We are implementing a solution that allows users to login via aad-login (Azure Active Directory login) following this guide: https://github.com/bureado/aad-login Everything works fine - I can login ...
0
votes
3answers
223 views

openvpn pam authentication failure

I am trying to setup PAM authentication on my openVPN instance running on Ubuntu Server 15.04 but i keep getting an authentication failed error, am i missing anything? server.conf port 1194 proto ...
1
vote
1answer
73 views

PAM authentication - Write error: broken pipe

In order to allow the 2FA in my domain, I setup a LinOTP server to manage the map between tokens and users (from LDAP) in my realm. So, I configured the PAM stack to integrate this authentication ...
0
votes
1answer
19 views

Nonsystem authentication for unprivileged sftpd

I am creating a test system that needs to be able to briefly act as a sftp server on a nonprivalaged port. The test system runs as a normal user. So I'm thinking as running sshd with the sftp ...
1
vote
1answer
46 views

Local credentials used when radius server is available sshd pam_radius

I have pam_radius setup and it works (centos6, pam_radius: 1.4.0-2.el6), i can authenticate via the radius server using ssh. What i am trying to accomplish is that when the radius server is ...
0
votes
0answers
16 views

Linux Samba Server: PAM?

I've read several places that the Linux Samba server cannot use PAM authentication - some say because of the challenge-response pattern and other say because it requires unencrypted passwords. ...
0
votes
0answers
96 views

pam_sss(sudo:auth): authentication failure

I'm having some CentOS 7 machines joined a windows domain with the following steps: #yum -y install realmd sssd oddjob oddjob-mkhomedir adcli samba-common #nmcli c modify eth0 ipv4.dns 192.168.3.18 #...
0
votes
1answer
84 views

Trying to execute a script with pam authentication

I want to be able to execute a custom script when pam does the authentication but I get an error out that I can't seem to pass: Feb 20 17:39:47 DC03R07DS25-08 sockd[2874]: pam_exec(sockd:auth): send ...
0
votes
0answers
29 views

do not allow multiple sessions if user have different IPs

I am running Red Hat Enterprise Linux 6.6 and for authentication we use LDAP authentication. We have running application on a server (doesn't really matter which one it is) and the way application ...
2
votes
0answers
124 views

Monitoring failed ssh logins with pam and bash?

I modified /etc/pam.d/common-auth to run a bash script when a login fails or when a login is successful and it works for successful logins but not failed login attempts when trying to ssh. Once I am ...
0
votes
1answer
32 views

configure a PAM module to be required for all but certain users for which it should be sufficient [duplicate]

I'd like to be able to configure /etc/pam.d/sshd so that: for all users except those in group "admin", module pam_radius is required. for those users in group admin, module pam_radius is sufficient....
1
vote
1answer
35 views

Detect SSSD authenticating domain programmatically in multi-domain environment

We have some servers in a mixed RH5/RH6 enthat need to authenticate to one of two LDAP services. This is implemented in SSSD and is running fine. Users from either domain can login successfully and ...
2
votes
0answers
387 views

Mac OSX - SSHD partially broken after El Capitan Upgrade

I recently upgraded my firm's Mac Mini device to El Capitan from Yosemite, and encountered several issues during the upgrade. I've gotten most of them resolved but one that's still failing is the SSH ...
0
votes
1answer
28 views

pam_tty audit logs gives too much of not required information

We are using pam_tty to record all the commands that user types. We are interested in monitoring the user commands. In the audit.log, when we grep for USER_TTY, there is too much of logging that ...