Questions tagged [pam]

Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

214 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
2 answers
2k views

Virtual users in sshd from a postgres database

I have a Postgresql database full of user accounts, and i would like to allow these user to access a server through ssh, using only public keys authentification. So far, i have setup these parts on ...
Bastien Abadie's user avatar
5 votes
2 answers
713 views

PAM vs /etc/shadow in Dovecot SASL configuration - Security differences?

I set up a server with Postfix SMTP auth through Dovecot SASL. However, it was not possible to get the PAM authentification working as standard out of the box. So more by chance, I changed it to ...
smartmic's user avatar
  • 151
4 votes
0 answers
4k views

Permission issue preventing increase in Open Files Limit in Ubuntu

My Digital Ocean droplet's ulimit -n yields 1024. Now it's a dedicated machine with Ubuntu 16.04, 32GB Ram, 16 Cores. I want to crank it up to 65535. The problem: I followed a bunch of steps to ...
Hassan Baig's user avatar
  • 2,515
4 votes
1 answer
1k views

Echo something before SSH prompt with pam_exec

I want to echo some text from a pam_exec script after a successful SSH login (pubkey) but before the script itself exits (2FA purposes). Whatever the script prints during its execution is displayed ...
Riccardo Salve's user avatar
4 votes
0 answers
700 views

Ldap client on CoreOS

Has anyone setup ldap on CoreOS before? If so, how does one do such a task? I have a cluster of CoreOS machines and I'm trying to hook up this service Foxpass https://www.foxpass.com/ to it for user ...
Christian Grabowski's user avatar
4 votes
0 answers
2k views

Ubuntu server + Samba + PAM + Apple OpenDirectory

Due to various reasons, we are looking to migrate our file servers from OS X Server 10.9 over to a true Samba implementation running on Ubuntu 14.04LTS. We have Ubuntu up and running with Samba ...
quickthyme's user avatar
3 votes
0 answers
938 views

sshd on Fedora: Recent changes to UsePAM break existing security; PermitRootPassword & UsePAM no not honored, minimal PAM config doesn't work either

I did upgrade on a Fedora Server and was SHOCKED to discover thousands of root attacks on my publicly facing servers and I can't seem to figure out how to stop them! To be clear; It IS possible to log ...
Richard T's user avatar
  • 1,242
3 votes
1 answer
9k views

id: user: no such user

I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
Gopal's user avatar
  • 31
3 votes
0 answers
684 views

Must `kinit` user's ticket manually before PAM can mount SMB home directory at login

Ubuntu 14.04 file server Ubuntu 14 Active directory (AD) server running Samba 4 Ubuntu 18 client (fresh install) I've configured for Ubuntu user home directories to be mounted via PAM and SMB/CIFS. ...
BurningKrome's user avatar
3 votes
0 answers
4k views

Local groups mapped to AD users via groups.conf working - but only with ssh login

I'm running a Samba Active Directory domain with Ubuntu 18.04 clients. I used the /etc/security/group.conf file to successfully create a mapping for domain users to the "dialout" group. I tested it ...
BurningKrome's user avatar
3 votes
0 answers
2k views

X11rdp/xrdp with aad-login -> pam authentication fails (xrdp_mm_process_login_response: login failed)

We are implementing a solution that allows users to login via aad-login (Azure Active Directory login) following this guide: https://github.com/bureado/aad-login Everything works fine - I can login ...
Christoph's user avatar
3 votes
0 answers
2k views

Monitoring failed ssh logins with pam and bash?

I modified /etc/pam.d/common-auth to run a bash script when a login fails or when a login is successful and it works for successful logins but not failed login attempts when trying to ssh. Once I am ...
Matkey's user avatar
  • 43
3 votes
0 answers
1k views

Mac OSX - SSHD partially broken after El Capitan Upgrade

I recently upgraded my firm's Mac Mini device to El Capitan from Yosemite, and encountered several issues during the upgrade. I've gotten most of them resolved but one that's still failing is the SSH ...
Nick L's user avatar
  • 31
3 votes
0 answers
682 views

PAM Google Authenticator With SFTP And Other Apps

I'm attempting to set up a situation where SSH Authorized Key + Google Authenticator Code is sufficient to ssh into the server. This is working fine for normal SSH terminal operations - I'm prompted ...
Ben's user avatar
  • 31
3 votes
1 answer
2k views

PAM Winbind Expired Password

We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted. What's the ...
steelcityamir's user avatar
3 votes
0 answers
9k views

User not recognized by underlying authentication

I'm running lxc on Linux Mint Debian Edition tracking Wheezy/Sid. I created a container using "lxc-create -t debian -n dev". In accordance with the Debian wiki article on LXC I have mounted the ...
Beau's user avatar
  • 131
2 votes
0 answers
397 views

PAM configuration popup yes or no for answer? after sudo apt install software-properties-common

I was trying to install the latest php version and after a command not found I googled it and they say to use the following command ''sudo apt install software-properties-common'' After doing this I ...
Peter Tremblay's user avatar
2 votes
0 answers
419 views

OpenVPN auth with Freeradius fails with error message: Module is unknown

I have installed an OpenVPN server with Easy-RSA. I generated the certificate and signed it on my CA Server and copied it back to VPN server. I can establish the client-server connection via ...
Houman's user avatar
  • 1,635
2 votes
0 answers
198 views

afpd[]: PAM audit_log_acct_message() failed: Operation not permitted

Im trying to debug this error in the /var/log/auth but I dont know where to look at. Jul 27 06:44:30 server afpd[6463]: PAM audit_log_acct_message() failed: Operation not permitted The syslog seems ...
OscarCy's user avatar
  • 33
2 votes
0 answers
3k views

PAM: password authentication failed for remote user

I am executing a command from server1 which would do a remote ssh to server2 and execute certain commands as olcne user. I am seeing some exception in /var/log/secure file wrt to pam. Can someone ...
user1115980's user avatar
2 votes
0 answers
2k views

Why all users are uid=0 when connecting through SSH?

I was testing some pam rules and I noticed that all users has uid=0 (root) when they log in to the system through SSH. Could be a reason that sshd starts automatically when the server boots up? How to ...
DRI's user avatar
  • 23
2 votes
0 answers
2k views

user pam.d configuration files to prevent updates overwriting them

My server is running and I have modified /etc/pam.d/common-password. When certain programs are installed or there are system updates, it needs to update that file so it asks me if I want to the file ...
IMTheNachoMan's user avatar
2 votes
0 answers
468 views

User Resource management: cgroups + systemd + ssh

I am trying to limit the memory of a single user that keeps crashing our OpenSuse Server. What I have done is as desribed here, to modify the limit of the user's slice via systemctl set-property ...
Johannes Bleher's user avatar
2 votes
1 answer
222 views

Access of users using google-authenicator without token

I'm using google authenticator pam module on CentOS to create a 2FA authentication for my users, however, I want that only the users that have already registered with the authenticator are asked to ...
Francisco Juarez ZAMora's user avatar
2 votes
1 answer
876 views

pam_winbind: unknown option require_membership_of

I'm trying to configure the VSFTPD with Winbind to restrict users authenticated by Active Directory, only to those that belong to specific group. I'm using a generic conf file for the vsftpd, with ...
Joao Bernardes's user avatar
2 votes
0 answers
3k views

All Free IPA clients unable to login

Environment: ~400 Servers enrolled in Prod IPA Prod IPA setup as Master/Master replication between two servers Around 4:40 PM yesterday users started reporting unable to login to servers via SSH. ...
Sysadmin123's user avatar
2 votes
3 answers
4k views

Google-authenticator with openvpn - AUTH: Received control message: AUTH_FAILED

I'm trying to set up MFA with Google authenticator for my OpenVPN setup on Ubuntu 16.04. Now OpenVPN works fine until I bring Google Authenticator into the mix. My server.conf file reads as follows: ...
Arjun Balakrishnan's user avatar
2 votes
1 answer
3k views

sshd pam_ldap: ldap_simple_bind Can't contact LDAP server

Seen lots of similar post regarding my issue but none so far have really contributed to resolving the matter. I have a bunch of old RHEL 5.5 servers which I need to authenticate against an LDAP ...
djc72uk's user avatar
  • 33
2 votes
0 answers
120 views

pam_afs_session: what does "PAG apparently lost" message in syslog mean?

We access our Debian Linux servers with ssh using GSSAPI. The servers run OpenSSH and take advantage of the pam-stack. In particular, they use pam_afs_session. Every once in a while I see the ...
user35042's user avatar
  • 2,711
2 votes
1 answer
4k views

Google Authenticator FreeRADIUS

I'm trying to implement google authenticator PAM module in FreeRADIUS on RHEL7. I've loosely followed this guide: http://www.supertechguy.com/help/security/freeradius-google-auth The reason I say ...
Justin Whelan's user avatar
2 votes
0 answers
3k views

pam_tally2 does not tally failed logins for failed SSH login attempts

Goal For mobile devices we wish to add an extra layer of security by requiring a PIN code upon ssh login. Mobile access is only a convenience service (users can always pull out their laptops) and ...
Luc's user avatar
  • 304
2 votes
0 answers
14k views

Unable to authenticate to AD using Kinit - cache file not found

I'm trying to set up Winbind with PAM and Kerberos to authenticate CentOS 7 against active directory. So far this is what I've done: yum -y install authconfig krb5-workstation pam_krb5 samba-common ...
GrahamBond's user avatar
2 votes
0 answers
691 views

SSH login with defined authentication methods

I have a small server, and I would like to be able to login using SSH with 2 methods: Public key Password and then a PAM made in Python I successfully installed libpam-python, and added this line to ...
Pita3145's user avatar
2 votes
0 answers
1k views

Kerberos-based SSH login requires local user account

I've recently set up a linux system (Debian-Jesse) which has joined an MS-Based Kerberos domain and been set up to allow Kerberos-based authentication for remote access. The only issue is, ...
Wesley Boynton's user avatar
2 votes
0 answers
3k views

pam_sss(sudo:auth): authentication failure

I'm having some CentOS 7 machines joined a windows domain with the following steps: #yum -y install realmd sssd oddjob oddjob-mkhomedir adcli samba-common #nmcli c modify eth0 ipv4.dns 192.168.3.18 #...
Gabriel's user avatar
  • 61
2 votes
0 answers
765 views

LDAP Not working for SSH connections on ubuntu 12.04

Connecting from the client to the server: $ ssh -vvv [email protected] OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 debug1: Reading configuration data /etc/ssh_config debug1: /etc/ssh_config line 20: ...
sclarson's user avatar
  • 3,684
2 votes
1 answer
652 views

vsftpd freezes after failed pam_script authentication

I have an Ubuntu 14.04 server with vsftpd and pam_script installed using apt-get. I've configured vsftpd to use pam_script for virtual user authentication and my /etc/pam.d/vsftpd file looks like this:...
edziubudzik's user avatar
2 votes
0 answers
767 views

How to add two-factor authetntication to ssh?

I am trying to add 2FA to sshd using PAM from oathtool package. I want two ways to login to server: publickey and 2FA, or password and 2FA So far I managed to add 2FA to publickey authentication, ...
mefju's user avatar
  • 153
2 votes
0 answers
2k views

How to mount share in pam_mount.conf.xml depending of OU

I have a Microsoft Windows domain and I want to add the ubuntu machines with Likewise-Open. There is no problem with that, but in my windows machines I have a GPO that mount a net share depending of ...
xabim's user avatar
  • 213
2 votes
1 answer
772 views

OpenLDAP on ArchLinux users cannot change passwd

I started an office and i NEED centralized login and home directories to work. Since all workstations are going to run Arch and problems with different LDAP versions I finally concluded the LDAP ...
iOfWhy's user avatar
  • 31
2 votes
0 answers
688 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
Theodor Keinstein's user avatar
2 votes
1 answer
7k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = email@...
grs's user avatar
  • 2,235
2 votes
0 answers
115 views

Set pam_unix password without knowing current password, having authenticated with pam_winbind

Right, so I have winbind authentication set up for login. However, I think there may still be some situations in which it would be useful for the user to be able to set their unix password (in the ...
Paul Gideon Dann's user avatar
2 votes
0 answers
416 views

pam_mysql / vsftpd error 'AUTHENTICATION FALURE (FIRST_PASS)'

I setup vsftpd and mysql auth via pam on Debian Squeeze. Config: auth required pam_mysql.so user=server passwd=x host=localhost db=server table=ftp usercolumn=username passwdcolumn=password ...
Daniel W.'s user avatar
  • 1,739
2 votes
1 answer
82 views

setting the "FROM" field in /usr/bin/w output

I'd like to set the FROM field in /usr/bin/w to various different strings that aren't my sshd's opinion of where the user has come from. Mostly this is because inbound ssh is often via on-host relays (...
Ben Clifford's user avatar
2 votes
2 answers
2k views

Add all network users to local group for specific hosts in CentOS7

How would I add a network (sssd-ldap) user to a local group? More specifically, how can I add all network users who log into a system to a local group? It doesn't look like authconfig has a setting ...
84104's user avatar
  • 13k
1 vote
0 answers
164 views

Can't authorise commands via tacacs+ server executed in shell by ssh

I've setup a tacacs+ server and a PAM tacacs client from here- https://github.com/kravietz/pam_tacplus/tree/main. When user ssh into the tacacs client machine, I want authentication from tacacs+ ...
Faisal Alam's user avatar
1 vote
0 answers
281 views

How to setup pam on debian 11

I have installed debian 11 and pam-ldapd. Now, I want to setup authenticating for openvpn with pam. When I wanted to test it with 'getent passwd' command, I got only local users response. Can you help ...
Dave's user avatar
  • 25
1 vote
0 answers
312 views

how to use PAM auth for ssh key clients?

How to unlock ssh private keys with PAM, so I can use fingerprintd module? There are many questions here discussing PAM and kerberos for sshd auth, but I can't find anything on the client side. Also, ...
gcb's user avatar
  • 72
1 vote
0 answers
702 views

Cron not working after pam customization to check groups

I need help with a PAM configuration. I've a Debian 11.5 machine with kerberos connected to an MS AD server. I want to configure the machine in order to allow some AD user to login, filtering them by ...
Lorenzo Sorace's user avatar

1
2 3 4 5