1
vote
1answer
21 views

skip 2 steps verification when there is ssh key Debian [closed]

I had installed 2 steps verification on my server using this great manual: http://support.jpgottech.com/knowledgebase.php?article=72 Everything works great but I had encountered a small issue, I want ...
3
votes
1answer
188 views

Public-Key -or- Password & Google Authenticator for SSH Login

I found an article (http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/) that explains how to configure OpenSSH to ask for a Google Authenticator ...
6
votes
1answer
65 views

Different “RequiredAuthentications2” for sshd and sftp subsystem

we're currently using a 2factor authentication on our SSH servers, so we have "RequiredAuthentications2 publickey,keyboard-interactive" in our sshd_config (publickey for the key, keyboard-interactive ...
2
votes
2answers
118 views

OpenSSH and PAM authentication using a public key

I'm looking for a way to authenticate users using a public key which is stored in a db (MongoDB). Similar questions usually resulted with a suggestion to installed a patched version of OpenSSH ...
1
vote
0answers
72 views

How to add two-factor authetntication to ssh?

I am trying to add 2FA to sshd using PAM from oathtool package. I want two ways to login to server: publickey and 2FA, or password and 2FA So far I managed to add 2FA to publickey authentication, ...
5
votes
3answers
2k views

pam service(sshd) ignoring max retries

I have vps that I use to run a webserver on, it currently runs ubuntu server 12.04. Since a few weeks I keep getting a lot of errors in my ssh console. 2014 Apr 11 08:41:18 vps847 PAM service(sshd) ...
0
votes
0answers
101 views

Run pam_exec after home directory creation CentOS 6

How can I make a pam_exec script in /etc/pam.d/sshd run after the home directory has been created? I am on CentOS 6.5 and use network accounts via PBIS / Likewise-Open. Right now, if a new user ...
5
votes
1answer
142 views

Combination of SSH key auth, and two-factor authentication

I was wondering if it is possible to accomplish the following, all at the same time: Disable root logins Enable SSH login for personal user, only via SSH keys Enable SSH login for unprivileged user, ...
2
votes
1answer
156 views

Prevent fork bomb inside docker container

I am currently struggling with limiting number of processes for user which I called sandbox. I configured processes limit inside /etc/security/limits.conf like this: sandbox hard nproc ...
3
votes
1answer
114 views

Virtual users in sshd from a postgres database

I have a Postgresql database full of user accounts, and i would like to allow these user to access a server through ssh, using only public keys authentification. So far, i have setup these parts on ...
0
votes
0answers
102 views

Mounting EncFS with PAM at SSH login with password protected key

I'm running OpenSUSE 12.3 on a VM in the cloud and have an EncFS directory set up. I can mount it manually fine. I'm trying to have the directory mounted at SSH login, ideally only for the duration ...
0
votes
1answer
143 views

Authenticate Radius user using pam and ssh [duplicate]

I am able to authenticate radius users using radius server+pam+ssh with creating local user with blank password in linux. Is it possible to authenticate radius users without creating users in local ...
1
vote
1answer
36 views

SSH listen on 2 ports, With a single config

Im trying to make SSH logins require 2 factor auth but only on one port. So port 1 is open only to a list of ip's managed by iptables. and only requires password / key port 2 is open to all, But ...
2
votes
3answers
466 views

How can I delay sshd login after bad password

How can I delay the retry response from SSH when a bad password is tried or unsuccessful login attempt. I wanted the delay to be 2-3 second more that usual. I could not find any option in ...
0
votes
0answers
38 views

How can I set path for non-interactive user authenticated using LDAP?

On a Mac running OSX 10.7.5, I need to set the PATH for non-interactive users who connect via ssh and are authenticated using LDAP. It's the same question that was asked (and answered) here: Updating ...
2
votes
1answer
205 views

PAM Winbind Expired Password

We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted. What's the ...
1
vote
1answer
80 views

SSH/ Telnet PAM configuration

How do I configure maximum number of login attempts before the session is dropped for SSH/telnet in PAM?
1
vote
1answer
3k views

ssh: “Access denied by PAM account configuration” for one non-root user but not another

On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is ...
0
votes
1answer
191 views

Strange Change in ssh behavior + LDAP

We have a cluster with a front node that admits normal users and LDAP users. Two days ago the ssh show a strange behavior: The LDAP users can't login in the front node using password but, The LDAP ...
3
votes
3answers
142 views

Is there a command line two-factor authentication verification code generator?

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup ...
1
vote
1answer
337 views

Restricting LDAP users from authenticating without a valid shell

What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
0
votes
2answers
131 views

Requiring two-factor ssh authentication only from certain clients

I am about to make two-factor authentication mandatory for ssh logins using libpam_google_authenticator. I'd like to be able to waive this requirement when users log in from certain IP addresses. ...
0
votes
2answers
980 views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
206 views

Call Pam module before public key authentication on SSH

I am currently writing a pam module which does some checks if the key stored in authorized_keys is still valid. However I cant find a possiblity to run the module before the public key authentication ...
2
votes
1answer
940 views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
0
votes
2answers
419 views

Whitelist IP from google-authenticator in sshd pam

My Ubuntu 12.04 server uses the google-authenticator pam module to provide two step authentication for ssh. I need to make it so that a certain IP does not need to type the verification code. The ...
1
vote
1answer
292 views

ssh login fails for user with empty password [closed]

How do you enable ssh login on OS X 10.8 (Mountain Lion) for a user with an empty password? I've seen others asking this question, and like me it's for the same reason: a parent who can't deal with ...
12
votes
2answers
221 views

SSH only works after intentionally failed password

So, I'm having a rather weird problem. I have a server, that when I try to SSH into, immediately closes the connection if I type in the correct password on the first attempt. However, if I ...
1
vote
1answer
427 views

Cannot login as root to centos server

I used to login as ssh root@servip with a password authentication into my CentOS 6 server. I am not sure if what I have done has caused this, but while trying to get over my problem of accessing ...
4
votes
1answer
881 views

Purpose Behind Disabling PAM in SSH

I'm setting up key based authentication for SSH on a new box, and was reading a few articles that mention setting UsePAM to no along with PasswordAuthentication. My question is, what is the purpose ...
2
votes
4answers
2k views

PAM module causes flurry of SSH sessions

While tailing /var/log/auth.log I noticed that there where multiple entries being entered (instantly) by the minute for user "foo". I personally had only one connection open as user "root_bar" while ...
1
vote
1answer
2k views

LdapErr: DSID-0C0903AA, data 52e: authenticating against AD '08 with pam_ldap

I have full admin access to the AD '08 server I'm trying to authenticate towards. The error code means invalid credentials, but I wish this was as simple as me typing in the wrong password. First ...
1
vote
3answers
1k views

How to use PAM to limit failed login attempts by IP?

I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
1
vote
3answers
374 views

Switching user in openssh using PAM

I'm trying to write a PAM module which will on login will compare the username provided against a list of "virtual" user names. If the username provided is a "virtual user" it will complete the ...
1
vote
3answers
250 views

Limiting SSH root logins to only “safe” networks in OpenSSH 4.x

We want to limit root SSH login to only a few networks that we consider "safe" (VPN, etc.) without imposing the same condition on other accounts. In OpenSSH 5.x, we could use the match block. ...
0
votes
2answers
127 views

Configure interactive keyboard authentication

I have a linux machine running OpenSSH Server 4.3. How can I configure it to use keyboard-interactive authentication - define prompts and responses and so on. Please be specific, as I am pretty new ...
2
votes
1answer
660 views

pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968]?

Why is the following log produced? pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968] Is it because of a timeout, or is there some other reason?
1
vote
1answer
391 views

error in auth.log but can login; LDAP/PAM

I have a server running OpenLDAP. When I start a ssh-session I can log in without problems, but an error appears in the logs. This only happens when I log in with a LDAP account (so not with a system ...
2
votes
1answer
893 views

Force SHA when user changes LDAP password using passwd

I'm trying to setup PAM/LDAP so that when a logged in SSH user changes their password using passwd, it encrypts the password with SHA1 before updating the LDAP entry. I have this # /etc/ldap.conf ... ...
0
votes
1answer
406 views

Per-user umask over all ssh connections

Following on from How to setup ssh's umask for all type of connections Is it possible to do this on a per-user basis? Here's what I have at the minute: /etc/pam.d/ssh sesssion optional ...
-4
votes
6answers
532 views

Limiting ssh connections with a daily amount [closed]

Would this be best done through PAM?
1
vote
1answer
423 views

map remote ssh user to a different local user

All my boxes have the same username for myself, except one legacy machine where I'm loath to try to change it. Whenever I ssh to the machine, I forget to specify my user name, and my password is ...
10
votes
4answers
8k views

How to get full control of umask/PAM/permissions?

// Updated Feb 8 - Outstanding issues in brief: How to umask directories differently from files? How to umask on Nautilus copy/paste? How to set umask for SSHFS? OUR SITUATION Several people from ...
2
votes
1answer
1k views

sshd: How to enable PAM authentication for specific users under

I am using sshd, and allow logins with public key authentication. I want to allow select users to log in with a PAM two-factor authentication module. Is there any way I can allow PAM two-factor ...
3
votes
4answers
1k views

/usr/bin/sshd isn't linked against PAM on one of my systems. What is wrong and how can I fix it?

I'm using AD as my user account server with ldap. Most of the servers run with UsePam yes except this one, it has lack of pam support on sshd. root@linserv9:~# ldd /usr/sbin/sshd ...
1
vote
3answers
781 views

How to dynamically restrict SSH access to a given user

The goal here is to create a script to easily manage reservation for a machine. When a user reserve the machine, it should be the only one able to access the machine for a given time (except admins of ...
1
vote
1answer
907 views

rhel configure: limit root direct login to systems except through system consoles

I have to configure to limit root direct access except system consoles. That is, the ways of telnet, ftp, SSH are all prohibited. Root can only login through console. I understand that will require me ...
1
vote
2answers
2k views

SSH + LDAP + pam_groupdn problem

I managed to install SSH + LDAP, moreover I authenticate users through pam_groupdn - if an user is in appropriate group, he is allowed to login to server. This is part of my pam.d account ...
2
votes
2answers
2k views

How to automatically create user accounts ( SSH + LDAP )

I set up remote LDAP server (Server1) and SSH with pam_ldap on Server2. Everything is working ok, I can login to SSH with LDAP credentials. But when I want to add new user, I have to firstly create it ...
2
votes
3answers
979 views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...