1
vote
1answer
64 views

Accept any SSH connection irrespective of client key

Imagine I'm setting up a honeypot, what would be the quickest way to setup SSHD to just accept any connection? and yes, this is really insecure, so please don't copy :-) Might be useful (put ...
1
vote
1answer
27 views

skip 2 steps verification when there is ssh key Debian [closed]

I had installed 2 steps verification on my server using this great manual: http://support.jpgottech.com/knowledgebase.php?article=72 Everything works great but I had encountered a small issue, I want ...
3
votes
1answer
384 views

Public-Key -or- Password & Google Authenticator for SSH Login

I found an article (http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/) that explains how to configure OpenSSH to ask for a Google Authenticator ...
6
votes
1answer
96 views

Different “RequiredAuthentications2” for sshd and sftp subsystem

we're currently using a 2factor authentication on our SSH servers, so we have "RequiredAuthentications2 publickey,keyboard-interactive" in our sshd_config (publickey for the key, keyboard-interactive ...
3
votes
2answers
308 views

OpenSSH and PAM authentication using a public key

I'm looking for a way to authenticate users using a public key which is stored in a db (MongoDB). Similar questions usually resulted with a suggestion to installed a patched version of OpenSSH ...
1
vote
0answers
103 views

How to add two-factor authetntication to ssh?

I am trying to add 2FA to sshd using PAM from oathtool package. I want two ways to login to server: publickey and 2FA, or password and 2FA So far I managed to add 2FA to publickey authentication, ...
6
votes
4answers
3k views

pam service(sshd) ignoring max retries

I have vps that I use to run a webserver on, it currently runs ubuntu server 12.04. Since a few weeks I keep getting a lot of errors in my ssh console. 2014 Apr 11 08:41:18 vps847 PAM service(sshd) ...
0
votes
0answers
142 views

Run pam_exec after home directory creation CentOS 6

How can I make a pam_exec script in /etc/pam.d/sshd run after the home directory has been created? I am on CentOS 6.5 and use network accounts via PBIS / Likewise-Open. Right now, if a new user ...
5
votes
1answer
176 views

Combination of SSH key auth, and two-factor authentication

I was wondering if it is possible to accomplish the following, all at the same time: Disable root logins Enable SSH login for personal user, only via SSH keys Enable SSH login for unprivileged user, ...
4
votes
1answer
256 views

Prevent fork bomb inside docker container

I am currently struggling with limiting number of processes for user which I called sandbox. I configured processes limit inside /etc/security/limits.conf like this: sandbox hard nproc ...
3
votes
1answer
147 views

Virtual users in sshd from a postgres database

I have a Postgresql database full of user accounts, and i would like to allow these user to access a server through ssh, using only public keys authentification. So far, i have setup these parts on ...
0
votes
0answers
126 views

Mounting EncFS with PAM at SSH login with password protected key

I'm running OpenSUSE 12.3 on a VM in the cloud and have an EncFS directory set up. I can mount it manually fine. I'm trying to have the directory mounted at SSH login, ideally only for the duration ...
0
votes
1answer
282 views

Authenticate Radius user using pam and ssh [duplicate]

I am able to authenticate radius users using radius server+pam+ssh with creating local user with blank password in linux. Is it possible to authenticate radius users without creating users in local ...
1
vote
1answer
37 views

SSH listen on 2 ports, With a single config

Im trying to make SSH logins require 2 factor auth but only on one port. So port 1 is open only to a list of ip's managed by iptables. and only requires password / key port 2 is open to all, But ...
2
votes
3answers
583 views

How can I delay sshd login after bad password

How can I delay the retry response from SSH when a bad password is tried or unsuccessful login attempt. I wanted the delay to be 2-3 second more that usual. I could not find any option in ...
0
votes
0answers
43 views

How can I set path for non-interactive user authenticated using LDAP?

On a Mac running OSX 10.7.5, I need to set the PATH for non-interactive users who connect via ssh and are authenticated using LDAP. It's the same question that was asked (and answered) here: Updating ...
2
votes
1answer
220 views

PAM Winbind Expired Password

We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted. What's the ...
1
vote
1answer
84 views

SSH/ Telnet PAM configuration

How do I configure maximum number of login attempts before the session is dropped for SSH/telnet in PAM?
1
vote
1answer
5k views

ssh: “Access denied by PAM account configuration” for one non-root user but not another

On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is ...
0
votes
1answer
215 views

Strange Change in ssh behavior + LDAP

We have a cluster with a front node that admits normal users and LDAP users. Two days ago the ssh show a strange behavior: The LDAP users can't login in the front node using password but, The LDAP ...
3
votes
3answers
180 views

Is there a command line two-factor authentication verification code generator?

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup ...
1
vote
1answer
412 views

Restricting LDAP users from authenticating without a valid shell

What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
0
votes
2answers
145 views

Requiring two-factor ssh authentication only from certain clients

I am about to make two-factor authentication mandatory for ssh logins using libpam_google_authenticator. I'd like to be able to waive this requirement when users log in from certain IP addresses. ...
0
votes
2answers
1k views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
220 views

Call Pam module before public key authentication on SSH

I am currently writing a pam module which does some checks if the key stored in authorized_keys is still valid. However I cant find a possiblity to run the module before the public key authentication ...
2
votes
1answer
1k views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
0
votes
2answers
448 views

Whitelist IP from google-authenticator in sshd pam

My Ubuntu 12.04 server uses the google-authenticator pam module to provide two step authentication for ssh. I need to make it so that a certain IP does not need to type the verification code. The ...
1
vote
1answer
306 views

ssh login fails for user with empty password [closed]

How do you enable ssh login on OS X 10.8 (Mountain Lion) for a user with an empty password? I've seen others asking this question, and like me it's for the same reason: a parent who can't deal with ...
12
votes
2answers
237 views

SSH only works after intentionally failed password

So, I'm having a rather weird problem. I have a server, that when I try to SSH into, immediately closes the connection if I type in the correct password on the first attempt. However, if I ...
1
vote
1answer
435 views

Cannot login as root to centos server

I used to login as ssh root@servip with a password authentication into my CentOS 6 server. I am not sure if what I have done has caused this, but while trying to get over my problem of accessing ...
4
votes
1answer
1k views

Purpose Behind Disabling PAM in SSH

I'm setting up key based authentication for SSH on a new box, and was reading a few articles that mention setting UsePAM to no along with PasswordAuthentication. My question is, what is the purpose ...
2
votes
4answers
2k views

PAM module causes flurry of SSH sessions

While tailing /var/log/auth.log I noticed that there where multiple entries being entered (instantly) by the minute for user "foo". I personally had only one connection open as user "root_bar" while ...
1
vote
1answer
2k views

LdapErr: DSID-0C0903AA, data 52e: authenticating against AD '08 with pam_ldap

I have full admin access to the AD '08 server I'm trying to authenticate towards. The error code means invalid credentials, but I wish this was as simple as me typing in the wrong password. First ...
2
votes
3answers
1k views

How to use PAM to limit failed login attempts by IP?

I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
1
vote
3answers
403 views

Switching user in openssh using PAM

I'm trying to write a PAM module which will on login will compare the username provided against a list of "virtual" user names. If the username provided is a "virtual user" it will complete the ...
1
vote
3answers
268 views

Limiting SSH root logins to only “safe” networks in OpenSSH 4.x

We want to limit root SSH login to only a few networks that we consider "safe" (VPN, etc.) without imposing the same condition on other accounts. In OpenSSH 5.x, we could use the match block. ...
0
votes
2answers
128 views

Configure interactive keyboard authentication

I have a linux machine running OpenSSH Server 4.3. How can I configure it to use keyboard-interactive authentication - define prompts and responses and so on. Please be specific, as I am pretty new ...
2
votes
1answer
771 views

pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968]?

Why is the following log produced? pam_unix(sshd:auth): auth could not identify password for [admin] - sshd[6968] Is it because of a timeout, or is there some other reason?
1
vote
1answer
456 views

error in auth.log but can login; LDAP/PAM

I have a server running OpenLDAP. When I start a ssh-session I can log in without problems, but an error appears in the logs. This only happens when I log in with a LDAP account (so not with a system ...
2
votes
1answer
949 views

Force SHA when user changes LDAP password using passwd

I'm trying to setup PAM/LDAP so that when a logged in SSH user changes their password using passwd, it encrypts the password with SHA1 before updating the LDAP entry. I have this # /etc/ldap.conf ... ...
0
votes
1answer
427 views

Per-user umask over all ssh connections

Following on from How to setup ssh's umask for all type of connections Is it possible to do this on a per-user basis? Here's what I have at the minute: /etc/pam.d/ssh sesssion optional ...
-4
votes
6answers
539 views

Limiting ssh connections with a daily amount [closed]

Would this be best done through PAM?
1
vote
1answer
443 views

map remote ssh user to a different local user

All my boxes have the same username for myself, except one legacy machine where I'm loath to try to change it. Whenever I ssh to the machine, I forget to specify my user name, and my password is ...
10
votes
4answers
9k views

How to get full control of umask/PAM/permissions?

// Updated Feb 8 - Outstanding issues in brief: How to umask directories differently from files? How to umask on Nautilus copy/paste? How to set umask for SSHFS? OUR SITUATION Several people from ...
2
votes
1answer
1k views

sshd: How to enable PAM authentication for specific users under

I am using sshd, and allow logins with public key authentication. I want to allow select users to log in with a PAM two-factor authentication module. Is there any way I can allow PAM two-factor ...
3
votes
4answers
1k views

/usr/bin/sshd isn't linked against PAM on one of my systems. What is wrong and how can I fix it?

I'm using AD as my user account server with ldap. Most of the servers run with UsePam yes except this one, it has lack of pam support on sshd. root@linserv9:~# ldd /usr/sbin/sshd ...
1
vote
3answers
807 views

How to dynamically restrict SSH access to a given user

The goal here is to create a script to easily manage reservation for a machine. When a user reserve the machine, it should be the only one able to access the machine for a given time (except admins of ...
1
vote
1answer
940 views

rhel configure: limit root direct login to systems except through system consoles

I have to configure to limit root direct access except system consoles. That is, the ways of telnet, ftp, SSH are all prohibited. Root can only login through console. I understand that will require me ...
1
vote
2answers
2k views

SSH + LDAP + pam_groupdn problem

I managed to install SSH + LDAP, moreover I authenticate users through pam_groupdn - if an user is in appropriate group, he is allowed to login to server. This is part of my pam.d account ...
2
votes
2answers
2k views

How to automatically create user accounts ( SSH + LDAP )

I set up remote LDAP server (Server1) and SSH with pam_ldap on Server2. Everything is working ok, I can login to SSH with LDAP credentials. But when I want to add new user, I have to firstly create it ...