0
votes
0answers
29 views

why did pam_tty_audit stop working?

I recently installed the following updates to my system: Upgrade: libpam-runtime:amd64 (1.1.8-3, 1.1.8-3.1), libpam0g:amd64 (1.1.8-3, 1.1.8-3.1), libpam-modules:amd64 (1.1.8-3, 1.1.8-3.1), ...
1
vote
1answer
45 views

Suse 11 Sp2 pam-config doesn't work

I try to add pam_ldap module in Suse 11 Sp1 Server 64 bit using: pam-config -a --ldap OS information: node01:~ # file $(which pam-config) /usr/sbin/pam-config: ELF 64-bit LSB executable, ...
1
vote
1answer
40 views

Is it possible to have one group or account authenticate locally, bypassing LDAP auth?

We have one RAC cluster of machines where the local UID:GID of a couple users (oracle and grid) do not match the UID:GID of those same users in LDAP. Ultimately we ought to change the UID and GID of ...
0
votes
0answers
145 views

LDAP: forced to change root password on every login

I have finally configured my new server as LDAP-client of my existing one. Now, every time I login as root, I am prompted to change my 'LDAP password': login as: root root@111.111.111.111's password: ...
2
votes
1answer
53 views

pam_tally2 causing unwanted lockouts with SCOM or Nervecenter

We use pam_tally2 in our system-auth config file which works fine for users. With services such as SCOM or Nervecenter it causes lockouts. Same behavior on RHEL5 and RHEL6 This is ...
0
votes
0answers
36 views

Getting PAM/user info into php - something like Net_Finger instead of a db?

I've got a very small user group who just need to login, upload, check and then move specific files to a different area when ready. Right now, I use the nginx PAM auth module to log them in against ...
0
votes
0answers
23 views

Linux PAM auth chain w/ module independence

I have a working PAM configuration using google_authentitcator in addition to the standard pam_unix password module as a two factor solution. In short it prompts (requisite) for a verification code ...
0
votes
1answer
708 views

CentOS PAM unable to open /etc/pam.d/system-auth

In gdm I have checked "Require smartcard login" but forgot about adding any smartcard for authentication. Then I've tried to boot from LiveCD and disable SC auth. Something went wrong and now I am not ...
3
votes
1answer
584 views

Public-Key -or- Password & Google Authenticator for SSH Login

I found an article (http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/) that explains how to configure OpenSSH to ask for a Google Authenticator ...
2
votes
1answer
183 views

build user chroot on first login

I'm using ldap for remote user authentication and I basically need to either figure out how to: a. chroot a user on machine b from machine a via nfs,(which doesn't seem possible without mounting ...
-1
votes
1answer
207 views

User authentication; PAM or Radius? [closed]

At college I'm part of a group of students that keep a server infrastructure running for the students. Lately we've been having a lot of trouble with the servers, and we decided that it's probably ...
1
vote
1answer
233 views

Use a PHP script to authenticate users on Linux

I have a web application running built in PHP using MySQL as database. I'm trying to give specific users access to a Linux system via SSH to perform simple command-line tasks. Since I do already have ...
2
votes
0answers
228 views

How to mount share in pam_mount.conf.xml depending of OU

I have a Microsoft Windows domain and I want to add the ubuntu machines with Likewise-Open. There is no problem with that, but in my windows machines I have a GPO that mount a net share depending of ...
1
vote
0answers
207 views

postgresql: invalid authentication method “pam”: not supported by this build

When I try to start postgresql 9.3.1 I receive this in startup log: # cat /var/lib/pgsql/pgstartup.log LOG: could not create IPv6 socket: Address family not supported by protocol LOG: invalid ...
0
votes
2answers
1k views

ulimit -n not changing - values limits.conf has no effect

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. This question is somewhat of a follow up to this question. open file descriptor limits.conf setting ...
2
votes
3answers
683 views

How can I delay sshd login after bad password

How can I delay the retry response from SSH when a bad password is tried or unsuccessful login attempt. I wanted the delay to be 2-3 second more that usual. I could not find any option in ...
4
votes
1answer
447 views

How to use PAM to check LDAP password for some users, yet always use UID/GIDs from local files?

For a subset of my users in /etc/passwd, I would like to configure PAM (on Linux) to do the password checking part of the logon against an LDAP server, ignoring that these users are actually are ...
1
vote
1answer
170 views

PAM Module works fine on i386 but fails on x64 when used in vsftpd

We have a custom PAM module that works fine on our i386 development machines but when we try and use it in production on our x64 production servers with vsftpd it fails. The PAM module has been ...
0
votes
1answer
121 views

system authentication and radius authentication

I am using CentOS 6.3 and want to enable ssh RADIUS authentication along with Centos system Authentication. Right now my server is firstly authenticated with RADIUS server. And after system ...
3
votes
1answer
446 views

How to make exception in password locking via pam_tally2 for specific user?

I need to make an exception for a specific user, so that his failed logins are not counted by pam_tally2, and well, this is not a root account (I'd use magic_root then). Is it doable?
0
votes
2answers
326 views

PAM LDAP configuration for non-local user authentication

I have a requirement to allow non-local user accounts to be logged in via LDAP authentication. Meaning, the user that is trying to login is allowed access, if the user account exists in LDAP server ...
1
vote
1answer
468 views

pam_tty_audit apparently not working

I just compiled pam_tty_audit module, because my Linux distro doesn't include it with the usual PAM modules. I included to the /etc/common-session the configuration line, as suggested in this ...
5
votes
4answers
256 views

Locking a user's account locally when kerberos is enabled

I'm trying to set up Chef-managed accounts for a group of machines with the following characteristics: If there is no local account, login is blocked. If there is a local account with SSH keys, use ...
0
votes
1answer
700 views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
3
votes
1answer
101 views

What does this plugable authentication module (PAM) “code” mean?

I am reading a configuration file for Linux PAM and am wondering what it means: auth [success=2 default=ignore] pam_krb5.so minimum_uid=1000 I understand that "auth" means this rule is ...
1
vote
0answers
60 views

Set pam_unix password without knowing current password, having authenticated with pam_winbind

Right, so I have winbind authentication set up for login. However, I think there may still be some situations in which it would be useful for the user to be able to set their unix password (in the ...
0
votes
1answer
260 views

restarting authconfig changes order of my /etc/nsswitch.conf

Here is my nsswitch.conf: passwd: files ldap sss shadow: files ldap sss group: files sss When I restart authconfig, it removes ldap from passwd, shadow, and group. Here's my ...
0
votes
2answers
149 views

Requiring two-factor ssh authentication only from certain clients

I am about to make two-factor authentication mandatory for ssh logins using libpam_google_authenticator. I'd like to be able to waive this requirement when users log in from certain IP addresses. ...
1
vote
1answer
1k views

Linux PAM pam_succeed_if.so

I've specified an AD security group in PAM to restrict which domain users can login. I've also restricted sessions for AD users to this group. This prevents a logged in user from doing an "su -" to ...
0
votes
2answers
1k views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
126 views

When changing passwords, how to let one PAM module check for old passwords and another to save new ones?

Our server is currently using the blowfish cipher to store passwords and it uses pam_unix2. We'd like to gradually switch to SHA. The idea is that all newly changed passwords would be hashed with SHA. ...
0
votes
2answers
311 views

validate only one user with pam ldap and nslcd

I want only user "theuser" to login to this host. I have tried the following in nslcd.conf: pam_authz_search (&(objectClass=posixAccount)(IsActive=TRUE)(uid=theuser)) but all can login. If ...
2
votes
1answer
303 views

Authenticate Git virtual users via PAM

Can Git authenticate virtual users via PAM? In particular, would Git require some additional utility, such as gitolite or gitosis?
2
votes
3answers
1k views

How to increase max FD limit for a daemon process running under a headless user?

To increase the FD limit for a daemon process running under a headless user on a Ubuntu Linux machine we did following changes in /etc/security/limits.conf soft nofile 10000 hard nofile 10000 We ...
2
votes
1answer
143 views

Customize PAM messages

I would like to customize my password expiration warnings. I figured PAM reads them from somewhere, but can't find from where. The question is relevant for both Ubuntu/Debian and Fedora/RHEL/CentOS. ...
1
vote
1answer
180 views

MySQL Password Authentication with Proxy Users and Group Mapping

I'm actually using MariaDB here, but I'm working under the pretext that MariaDB is a "drop in replacement" for MySQL. I won't be surprised if this winds up being a cross platform difference/issue, but ...
2
votes
1answer
913 views

How do I disable password complexity in pam

I found tons of articles how to enable password complexity, can someone guide me to how to disable it? (oracle linux) This is my system-auth #%PAM-1.0 # This file is auto-generated. # User changes ...
2
votes
1answer
699 views

Linux ldap authentication, pam_filter ignored

I've set up linux client authentication via ldap, it works. I want to control user's access to several services by adding or removing different OUs for accounts. E.g., if user is allowed to login ...
3
votes
1answer
118 views

Can I use both the RSA 2-Factor PAM and an Active Directory PAM at the same time?

Let's use the product formerly known as Likewise as an example. I can very easily install this on a Linux machine and join it to an Active Directory domain. I can also use an RSA PAM module so that ...
0
votes
1answer
72 views

Can you use LDAP and PAM to implement a restricted shell?

Can you use LDAP and PAM to implement a restricted shell and control those users via groups on the LDAP DC? I would like to do this for several Red Hat, Solaris and Ubuntu servers? Thanks!
1
vote
3answers
55 views

Rip authentication from LDAP to local

We are taking a small portion of our network offline, and running a separate network using that portion. (By small portion I mean 2 servers, that will be connected to 30 odd boxes that aren't usually ...
1
vote
1answer
1k views

libpam-ldapd not looking for secondary groups

I'm migrating from libpam-ldap to libpam-ldapd. I'm having some trouble gathering the secondary groups from LDAP. On libpam-ldap, I had this on the /etc/ldap.conf file: nss_schema rfc2307bis ...
1
vote
2answers
1k views

Why isn't my cronjob running?

I have a cronjob in /etc/cron.d/mycron that looks like this: 0 3 * * * apache php /path/to/my/script.php In the same file there are other cronjobs begin run as root and other users (which ...
2
votes
1answer
417 views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
1
vote
1answer
461 views

Can't configure PAM + LDAP on Debian Lenny - Getting error=49 on server logs

I've been migrating some servers and desktops using Ubuntu 10.04 from getting the users from an old OpenLDAP implementation to a newer Centos Active Directory. I haven't had any problems so far, until ...
2
votes
1answer
448 views

pam_cracklib on Linux: how to disable credits

The pam_cracklib 'minlen' does not work as I want it to. PAM allows passwords even with lesser length than it is set to with the 'minlen' option. It gives credits (by default 1) to the 'upper-case', ...
5
votes
1answer
4k views

Users cannot use crontab after password security upgrade

I have a box being upgraded from CentOS 5 to CentOS 6. On the original server, all users have MD5 passwords. The upgraded server is now using SHA-512 passwords. Users who have changed their password ...
2
votes
2answers
544 views

pam_unix(su:session): session opened for user

Jun 26 15:58:52 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0) Jun 26 15:59:02 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0) Jun 26 ...
10
votes
3answers
2k views

How to deny access to disabled AD accounts via kerberos in pam_krb5?

I have a working AD/Linux/LDAP/KRB5 directory and authentication setup, with one small problem. When an account is disabled, SSH publickey authentication still allows user login. It's clear that ...
3
votes
1answer
459 views

Should pam_mkhomedir go in /etc/pam.d/login , sshd or system-auth?

I want to enable pam_mkhomedir.so for users who authenticate to our system. I want a user's home directory to be created when they SSH into the box. One common convention seems to be to put ...