Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
0answers
6 views

Can't setup mount of EncFS on user login

I've tried to setup EncFS to be mounted on user login as described in this guide excluding the Password Utility section, however it works with little success. The EncFS works properly ...
1
vote
2answers
19 views

Postfix omits realm (@domain) when checking for smtpd pam+mysql authentication

I've trying to configure Postfix so users can send email through SMTP having a username and password. And I'm trying to store credential within a MySQL database. I've taken the path of saslauthd and ...
1
vote
0answers
48 views

Slow ssh login - Activation of org.freedesktop.login1 timed out

On one of my servers I've noticed really delay on SSH logins. Connecting using the ssh -vvv options the delay occurs at debug1: Entering interactive session. extract of connection: debug1: ...
0
votes
1answer
29 views

pam google authenticator can't compute location of secret file

I've installed Google Authentication on all the machines in our system, and while the authentication during login works fine, our machines are producing logs that have this line over and over: ...
0
votes
0answers
17 views

how to get my kvm-nodes monitored by the opennebula-server

I just set up an OpenNebula server with the oned running. I also set up a kvm-node to deploy virtual machines on. When I tried to add the kvm-node to the OpenNebula server with onehost create ...
2
votes
1answer
57 views

cannot login via ssh

Can not login to SLES server via ssh as user1. At the same time I can login as root user without any problem. Authentication method is password based. In /etc/ssh/sshd_config I have ...
0
votes
0answers
26 views

centos7 pam_authz_search for *.group.company.com

Upgrading from Centos6 where we were using ldap.conf entry "pam_check_host_attr=yes" previously, with wildcard 'host' attribute in ldap where the host attribute looked like 'host=*.group.company.com' ...
0
votes
0answers
40 views

SSO Linux and AD Trusted Domain

Having successfully built a one-way trust between 2 AD domains, we can't lookup/id the user in the trusted domain. Here's our use case. AD1: dom1.com (Win2k8 R2) - One-way outgoing trust to AD2 ...
1
vote
2answers
67 views

pam_limits: Operation not permitted for sshd

Debian 8.0, pam 1.1.8-3.1, sshd 1:6.7p1-5. I'm trying to permanently increase the maximum number of open files. In /etc/pam.d/ I've got: /etc/pam.d# grep pam_limits.so * atd:session required ...
1
vote
1answer
21 views

How does pam_limits decide on the default limits?

In a linux system that is using the pam_limits module, but has nothing configured in /etc/security/limits.conf (or /etc/security/limits.d/*) how does pam_limits decided on what limits to implement?
3
votes
1answer
92 views

ssh as user runs program with no authentication (neither password nor keys)

I'd like to set up a user on my system (Ubuntu 14.04 x64) such that people can run ssh example@myhost.example.com and see some output from a program without being prompted for a password or having to ...
1
vote
0answers
41 views

Ubuntu 14.04 “azureuser” exists - and I did not create it

I just logged into an Ubuntu 14.04 instance and in the home folder there is a user "azureuser" (yes, this is an Azure VM) with four items in it: .ssh (folder) .bash_logout (file) .bashrc (file) ...
2
votes
0answers
75 views

LDAP Not working for SSH connections on ubuntu 12.04

Connecting from the client to the server: $ ssh -vvv user@10.0.50.170 OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 debug1: Reading configuration data /etc/ssh_config debug1: /etc/ssh_config line 20: ...
3
votes
1answer
102 views

LDAP authentication fails

I try to set up an LDAP directory that will allow me to authenticate Debian users. Once the configuration of the LDAP server and PAM files is done, the authentication fails. I think the client doesn't ...
1
vote
0answers
20 views

The differences between libpam-ldap and libpam-ldapd, included packages and modules? [duplicate]

May I ask what's the differences between libpam-ldap and libpam-ldapd when it comes to included packages and modules? As i understand is nss-pam-ldapd the project of libpam-ldapd, which is an ...
1
vote
0answers
24 views

Remote home-folders with optional but preferred locally-encrypted folder

I have the use case that on default all users are working within remote mounted home directories. However, sometimes they prefer a local home on one or more machines, e.g. because the network is too ...
2
votes
2answers
178 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
2
votes
1answer
52 views

SSHD applying different PAM rules for localhost connections

I am attempting to implement Yubikey auth via SSH. I've edited my /etc/pam.d/sshd file as follows, and it seems to work while connecting locally (ssh user@localhost): #%PAM-1.0 auth required ...
1
vote
0answers
28 views

How to properly automount tmpfs inside encrypted home folder on login?

I have a user with encrypted home folder which is automounted on login with pam_ecryptfs module. I would also like to have several folders automounted as tmpfs using local configuration file from ...
-1
votes
1answer
80 views

Curious what server pam_pwdfile is in var/log/messages

I am getting tons of these messages in my /var/log/messages file Apr 16 06:58:20 server pam_pwdfile[7856]: couldn't open password file /etc/techproxy.shadow Apr 16 06:58:20 server pam_pwdfile[7863]: ...
0
votes
2answers
57 views

Disable ssh login on specified time for particular users

I would like to disable ssh login to my system for particular users say X,and Y on specified time 17.00 to 18.00. so how to achieve this ? any help would be appreciated.
2
votes
1answer
113 views

Is it possible to ignore a missing PAM module?

I am configuring yubico-pam to enable passwordless sudo access using challenge-response from a Yubikey. The following works: # /etc/pam.d/sudo auth sufficient pam_yubico.so ...
0
votes
1answer
43 views

How can I change the directory in wich pam_mkhomedir creates the user's home directories?

I am using pam_mkhomedir to automatically create user's home directories when they first log in. However, the home directories are created inside the /home directory, while i need them to be created ...
0
votes
0answers
32 views

OpenLDAP with GOSA² Host-Authentication (accessTo attribute of User)

i'm having a problem with rebuilding our LDAP in combination with GOSA². We are hosting several linux machines and not all users may have access to all of them. In the past we realized this as a ...
14
votes
2answers
1k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
1
vote
1answer
133 views

Check if account is allowed when using pam_access

I'm using pam_access and /etc/security/access.conf to restrict who can login to my Rhel 6.5 hosts. I have an LDAP server with a diverse user base, and the security people would like a list of who can ...
0
votes
1answer
137 views

migrate samba users to new server

I've read How to migrate Samba User Accounts to a new linux server? however it doesn't address my situation, or at least not with a solution. I have a RHEL 5 machine, wood, running Samba, Dovecot, ...
3
votes
1answer
26 views

Use more complex AND/OR structure with PAM

PAM allows to use sufficent and required for some logic, like auth sufficient pam_a.so auth required pam_b.so auth required pam_c.so which would mean "either a is true, or b must be true and then c ...
0
votes
1answer
167 views

Unable to authenticate LDAP client with PAM when pwdReset = TRUE

I have searched tons of webs and tutorials but I couldn't find an answer to my problem. I have set up OpenLDAP 2.4 on a OpenSUSE 12.3 machine with a password policy overlay. The client is a Linux ...
1
vote
1answer
1k views

Fedora 21 pam_sss authentication failure - permission denied

We have configured a OpenLDAP server which is working fine. FreeBSD, Debian, and a WordPress plugin authenticate with no problems. We are configuring Fedora 21 with pam_sss, but we get the following ...
0
votes
1answer
157 views

tacacs+ for Linux authentication/authorization using pam_tacplus

I am using TACACS+ to authenticate Linux users using pam_tacplus.so PAM module and it works without issues. I have modified the pam_tacplus module to meet some of my custom requirements. I know by ...
1
vote
2answers
197 views

How to filter ldap user logins on linux?

I have several linux servers (ubuntu 12.04) setup to authenticate user logins over an external (to my branch office) LDAP (Novell Edirectory specifically). This is working well, however I am trying to ...
1
vote
1answer
47 views

What's the downside of disabling PAM in OpenSSH if only public-key login is allowed?

/etc/ssh/sshd_config by default has the following line UsePAM yes I read through available documentation and came to the conclusion that PAM is not used if I only use public-key login. What ...
2
votes
1answer
100 views

vsftpd freezes after failed pam_script authentication

I have an Ubuntu 14.04 server with vsftpd and pam_script installed using apt-get. I've configured vsftpd to use pam_script for virtual user authentication and my /etc/pam.d/vsftpd file looks like ...
0
votes
0answers
66 views

ProFTPd won't allow me to log in after password change

I've changed a password for one of my users (using passwd username), and now ProFTPd won't allow that user to log in. Other users can still log in as normal. I'm running Ubuntu 14.04 LTS The error ...
0
votes
1answer
212 views

pam_mount not working when logging in from ssh or console

okay so i configured pam_mount on my centos 6 machine as i did on my centos 7 and 5 machines. But when i login locally or via ssh, pam_mount can't mount my home dir. when i login with a local user, ...
2
votes
1answer
238 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
0
votes
1answer
138 views

How to override a user's UID coming from an LDAP directory?

I am trying to setup Linux logins for users in an LDAP directory. The directory contains users which have a UID under 1000 and I believe this is causing problems with logins to those accounts as UID ...
1
vote
1answer
70 views

Can I configure pam_ldap without configuring nss?

On my servers I have my system users provisioned with Chef and have no desire to expose any additional users to these machines. I would however like to utilize pam for the authentication backend for ...
2
votes
2answers
242 views

Debugging a Postfix Saslauthd PAM-PGsql authentication failure

I've set up pam-pgsql to lookup passwords in my database for Postfix via Saslauthd. I can test credentials using the command line: $ sudo testsaslauthd -u user@email.com -p password 0: NO ...
0
votes
2answers
410 views

sendmail & sasl auth on CentOS 6

I'm moving a mail server from one CentOS 6 to another. I use sendmail with sasl pam authentication. When I try to send mail it fails because the user is not authenticated and the mail client does not ...
3
votes
2answers
1k views

Join Red Hat Linux 6 to a Windows Active Directory Domain

I am using Red Hat 6 (for testing purpose) and configure samba with active directory.Red Hat 6 has successfully join with my windows server 2003 domain. By typing the command [root@mainserver /] # ...
0
votes
1answer
224 views

pam_mount on centos won't mount cifs

so I have this problem that pam_mount won't mount my cifs home dirs pam_mount has this in /var/log/messages: Feb 3 15:49:18 centosy nslcd[1278]: [3c9869] <passwd="tomas"> (re)loading ...
0
votes
2answers
119 views

Linux smart card authentication

I am using puttysc to authenticate to a remote Linux server with my smart card . But as I understand, this isn't true PKI authentication - puttysc just unlocks the public key and matches it to a user ...
2
votes
1answer
82 views

fail2ban did not ban anything, regardless of the settings

this is the first time that i did not find a solution here. so, hopefully it can be solved. i've installed a fresh, new ubuntu minimal system (14.04) with ssh on it. Right after that i installed ...
0
votes
0answers
120 views

pam_tally is not supporting user locking after failed attempts on CentOS

After adding the below configurations in /etc/pam.d/system-auth. The user account is not getting locked after multiple failed attempts. As per the below configuration the account should be locked ...
1
vote
2answers
117 views

Configuring PAM with Augeas

I am attempting to use Augeas to configure the files in my /etc/pam.d directory in a default Ubuntu 14.04 install. My goal is to find all nodes that have an argument of either 'nullok' or ...
11
votes
2answers
490 views

What do the OS X authorization mechanisms actually do?

Background  I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On. Please do correct me if I'm wrong, but I believe ...
2
votes
4answers
690 views

PAM, RADIUS, Google Authenticator and Two Factor Auth

I have setup FreeRADIUS, PAM and the Google Authtenicator. FreeRADIUS calls PAM, which in turn calls the Google pam_google_authenticator.so libary. That all works successfully. However, that's not ...
1
vote
2answers
290 views

Sending automatic mail on ssh-login fails

I'm trying to let my server send me automatically an email on ssh-login. What I've done: Created a login-notify.sh file (user root, group root, chmod 755) and placed it inside /etc/ssh/ #!/bin/sh ...