1
vote
2answers
153 views

PBIS Open AD authentication stops working on ubuntu with errors: “user accout has expired” and “is your account locked?”

We have been using PowerBroker Identity Services Open to authenticate active directory users from ubuntu hosts successfully for six months. Recently AD authentication stopped working on several ...
0
votes
1answer
44 views

openSUSE 13.1 pam_ldap error trying to bind invalid credentials

Environment: new install of openSUSE 13.1 into a internal network of mostly 10.2 and 10.3 openSUSE. LDAP server (@(#) $OpenLDAP: slapd 2.3.19 (Jul 28 2006 17:00:02)) running on SUSE LE 10 . ...
2
votes
2answers
79 views

pam_ldap and ldaps can't contact ldap server

I'm trying to allow authentication via LDAP on a CentOS host system. But I always get a Can't contact LDAP server error from pam_ldap. The LDAP server is pingable and authentication works perfectly ...
0
votes
0answers
30 views

why did pam_tty_audit stop working?

I recently installed the following updates to my system: Upgrade: libpam-runtime:amd64 (1.1.8-3, 1.1.8-3.1), libpam0g:amd64 (1.1.8-3, 1.1.8-3.1), libpam-modules:amd64 (1.1.8-3, 1.1.8-3.1), ...
0
votes
0answers
45 views

pam-mysql: “Failed password” when using hash methods

today I installed mysql-pam in order to store user credentials for ssh logins in a mysql database. At first I set users.password_crypt = 0, which means that plain passwords are saved in the db. After ...
1
vote
0answers
198 views

passwd: Authentication token manipulation error

I am running a Ubuntu 12 machine, and have recently been working to secure it. I made all the changes from this guide. I am not running a Linode, but I used these as a starting point for setting up ...
1
vote
1answer
190 views

Token error when trying to change password through pam-mysql

I am currently preparing a machine for a web hosting service, and I decided to use MySQL to store all our users (since the rest of our services use it already). For that, I am using libnss-mysql and ...
0
votes
0answers
36 views

Getting PAM/user info into php - something like Net_Finger instead of a db?

I've got a very small user group who just need to login, upload, check and then move specific files to a different area when ready. Right now, I use the nginx PAM auth module to log them in against ...
3
votes
1answer
259 views

Understanding PAM authentication procedure on FreeBSD with security/sssd

I'm trying to understand what's behaving errantly on my PAM configuration on FreeBSD 10.0 The machine is configured with two different authentication realms, one is the default Unix authentication ...
0
votes
0answers
155 views

authenticating and authorizing linux users kept in mysql database using pam and nss

I am not able to authenticate and authorize users present in my mysql database. If someone can point out where I am wrong it would be very helpful.Following are the steps that I followed. Firstly I ...
3
votes
2answers
518 views

OpenSSH and PAM authentication using a public key

I'm looking for a way to authenticate users using a public key which is stored in a db (MongoDB). Similar questions usually resulted with a suggestion to installed a patched version of OpenSSH ...
1
vote
0answers
128 views

How to add two-factor authetntication to ssh?

I am trying to add 2FA to sshd using PAM from oathtool package. I want two ways to login to server: publickey and 2FA, or password and 2FA So far I managed to add 2FA to publickey authentication, ...
0
votes
1answer
1k views

How to I authenticate with Dovecot + IMAP + PAM on CentOS?

I set up Dovecot IMAP to use PAM as suggested here: http://wiki2.dovecot.org/PasswordDatabase/PAM PAM/dovecot [root@ip-172-31-15-65 pam.d]# cat dovecot #%PAM-1.0 auth required ...
-1
votes
1answer
209 views

User authentication; PAM or Radius? [closed]

At college I'm part of a group of students that keep a server infrastructure running for the students. Lately we've been having a lot of trouble with the servers, and we decided that it's probably ...
0
votes
0answers
25 views

libnss-pgsql logging transaction on screen

I've been configuring a pg database to authenticate user against pam. I installed libpam_pgsql and libnss_pgsql2. After I finish configuring the libnss_pgsql2, creating and editing the nss-pgsql.conf ...
1
vote
1answer
233 views

Use a PHP script to authenticate users on Linux

I have a web application running built in PHP using MySQL as database. I'm trying to give specific users access to a Linux system via SSH to perform simple command-line tasks. Since I do already have ...
0
votes
0answers
364 views

Netatalk authentication randomly fails over WiFi

Background info: I have an Ubuntu 12.04 server on which I have Samba (v3.6.3) and Netatalk (v3.1.0) installed. I use TimeMachine on my Mac to backup to the Ubuntu server over AFP provided by ...
0
votes
0answers
154 views

How to ask memcached auth connection by sasl and pam?

I use memcached in a untrust network, so I try to use sasl and pam to auth connection to memcached. I installed sasl and pam module, compiled and installed memcached with sasl enabled. Also I created ...
4
votes
2answers
721 views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
3
votes
1answer
447 views

How to make exception in password locking via pam_tally2 for specific user?

I need to make an exception for a specific user, so that his failed logins are not counted by pam_tally2, and well, this is not a root account (I'd use magic_root then). Is it doable?
2
votes
1answer
345 views

How can I limit failed sasl2/pam_mysql login retries?

I have Postfix setup serving multiple virtual domains on a CentOS box - and all works as expected. Client's login are authenticated through sasl2 (saslauthd) and pam_mysql. And when a login attempt ...
0
votes
1answer
160 views

LDAP queries for local users

Recently, in the company where I work, we have had a general system crash and we are figuring out the causes. Our machines are configured for LDAP authentication plus some local users in some of them. ...
0
votes
2answers
326 views

PAM LDAP configuration for non-local user authentication

I have a requirement to allow non-local user accounts to be logged in via LDAP authentication. Meaning, the user that is trying to login is allowed access, if the user account exists in LDAP server ...
3
votes
3answers
209 views

Is there a command line two-factor authentication verification code generator?

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup ...
0
votes
1answer
132 views

Lag between PAM password acceptance and session open on CentOS5

I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
0
votes
2answers
200 views

Can't get pam_time.so to work with http

The /etc/security/time.conf man page contains this example: All users except for root are denied access to console-login at all times: login ; tty* & !ttyp* ; !root ; !Al0000-2400 For this ...
2
votes
1answer
72 views

configuring pam with flat files backend

I would like to configure pam module to use flat files for authentication. Basically I need same thing like pam_unix just with possibility to use different files (other than /etc/passwd and ...
0
votes
0answers
368 views

Why would Dovecot POP3 and IMAP Authentication from external IP address stop working?

Over a year ago I setup a Dovecot 1.2.9 POP3/IMAP server (which works alongside a Postfix SMTP server) with PAM authentication. This has been operating (I believe) without incident until recently ...
1
vote
1answer
329 views

Ubuntu 12.10 - Can't find my logs

Up until few days ago, my Ubuntu 10.04 worked like a clock. Then I switched to Ubuntu 12.10 and things don't work the same way with this setup. First, the new system wasn't logging any mail activity, ...
1
vote
1answer
211 views

MariaDB + PAM: Is Remote Auth Secure?

I have a MariaDB instance which is using PAM to auth against Active Directory. Is remote authentication with this service secure? I ran a Wireshark trace during the auth process, and passwords are not ...
2
votes
1answer
915 views

How do I disable password complexity in pam

I found tons of articles how to enable password complexity, can someone guide me to how to disable it? (oracle linux) This is my system-auth #%PAM-1.0 # This file is auto-generated. # User changes ...
0
votes
1answer
3k views

How do you configure /etc/pam.d/system-auth-ac on CentOS 6 using authconfig?

I'm trying to replace the cracklib module with passwdqc. Every time I do an authconfig --update (or --updateall), the changes I make on the system-auth-ac file goes away. The authconfig command line ...
12
votes
2answers
247 views

SSH only works after intentionally failed password

So, I'm having a rather weird problem. I have a server, that when I try to SSH into, immediately closes the connection if I type in the correct password on the first attempt. However, if I ...
1
vote
0answers
446 views

CentOS PAM+LDAP login and host attribute

My system is CentOS 6.3, openldap is configured well, PAM authorization works fine. But after turning pam_check_host_attr to yes, all LDAP-auths fail with message "Access denied for this host". ...
1
vote
3answers
55 views

Rip authentication from LDAP to local

We are taking a small portion of our network offline, and running a separate network using that portion. (By small portion I mean 2 servers, that will be connected to 30 odd boxes that aren't usually ...
5
votes
2answers
1k views

Nginx with PAM authentication through pam_script

Have anyone set up such a configuration? It's not working for me. I've installed nginx-extras on Ubuntu 12.04 (it's built with PAM module), and added to site config: location ^~ /restricted_place/ { ...
0
votes
1answer
604 views

PAM Errors in auth.log [Debian Squeeze]

Based on the the Securing Debian article on debian.org, I added the following to /etc/pam.d/other. auth required pam_securetty.so auth required pam_unix_auth.so auth required ...
2
votes
4answers
3k views

PAM module causes flurry of SSH sessions

While tailing /var/log/auth.log I noticed that there where multiple entries being entered (instantly) by the minute for user "foo". I personally had only one connection open as user "root_bar" while ...
1
vote
2answers
594 views

LDAP and pam without binddn and anonymous access

I am working in a large company and can use its central read-only LDAP server remotely. The LDAP server does not allow anonymous binding. In order to use this server for authentication of the users on ...
4
votes
1answer
231 views

Weird stuff in in my /var/log/auth.log

I just check my logs on my deed server, I spotted some weird log in the auth.log: Jun 17 22:27:01 mutualab CRON[16249]: pam_unix(cron:session): session opened for user user by (uid=0) Jun 17 22:27:01 ...
2
votes
3answers
1k views

How to use PAM to limit failed login attempts by IP?

I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
0
votes
1answer
310 views

login faild when autorize dovecot from pam

I installed dovecot 2.0.13 with postfix in ubuntu server 11.10 , after installation I can send e-mail with the mail command and dovecot works when I test it with telnet I then installed roundcube on ...
4
votes
1answer
3k views

How to use nginx PAM module?

I would like to use nginx PAM module to authenticate a site with existing users on a FreeBSD system. I tried to use pam_unix.so, but no luck. It's just not let me in with my usr/psw pair. :( nginx ...
4
votes
2answers
968 views

How to grant su access to wheel without asking for password on FreeBSD?

I would like to grant users of the wheel group (other sysadmins) su access without being asked for password. I know how to do it with pam in linux, but the question now is for FreeBSD. I am not ...
1
vote
1answer
1k views

Account lockout using Openldap

What is the best way to implement account lockout in openldap? I have an openldap server with Ubuntu desktop client connecting to it for authentication. I want he accounts to locked out after say 5 ...
4
votes
6answers
2k views

How to customize telnet login prompt on linux

When I run login command on debian, I get: hostname login: _ on RHEL5, Solaris or HP-UX I get: login: _ I need to be able to customize login: and password: prompts it on a Linux box. I can ...
3
votes
2answers
964 views

Account lockout in Ubuntu

I am trying to implement account lockout for Ubuntu systems using pam_tally. The login should be disabled for certain interval on 3 invalid login attempts. This should happen for both system and LDAP ...
0
votes
1answer
674 views

Google Authenticator PAM for specific users

My current sshd PAM config: #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session ...
0
votes
2answers
2k views

Cyrus on CentOS with sasl / pam / ldap

SASL/PAM/LDAP is driving me crazy... that's what I read a lot when googling for problems in this area, and what I experience myself :-S I'm trying to get Cyrus imap working for virtual hosting on ...
4
votes
3answers
2k views

libpam-ldap or libpam-ldapd?

I'm setting up LDAP authentication on my personal VPS, and Ubuntu has two packages for the same purpose: libpam-ldap and libpam-ldapd. Which should I use?