Questions tagged [pam]
Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
214
questions with no upvoted or accepted answers
6
votes
2
answers
2k
views
Virtual users in sshd from a postgres database
I have a Postgresql database full of user accounts, and i would like to allow these user to access a server through ssh, using only public keys authentification.
So far, i have setup these parts on ...
5
votes
2
answers
713
views
PAM vs /etc/shadow in Dovecot SASL configuration - Security differences?
I set up a server with Postfix SMTP auth through Dovecot SASL. However, it was not possible to get the PAM authentification working as standard out of the box.
So more by chance, I changed it to ...
4
votes
0
answers
4k
views
Permission issue preventing increase in Open Files Limit in Ubuntu
My Digital Ocean droplet's ulimit -n yields 1024. Now it's a dedicated machine with Ubuntu 16.04, 32GB Ram, 16 Cores. I want to crank it up to 65535.
The problem:
I followed a bunch of steps to ...
4
votes
1
answer
1k
views
Echo something before SSH prompt with pam_exec
I want to echo some text from a pam_exec script after a successful SSH login (pubkey) but before the script itself exits (2FA purposes).
Whatever the script prints during its execution is displayed ...
4
votes
0
answers
700
views
Ldap client on CoreOS
Has anyone setup ldap on CoreOS before? If so, how does one do such a task? I have a cluster of CoreOS machines and I'm trying to hook up this service Foxpass https://www.foxpass.com/ to it for user ...
4
votes
0
answers
2k
views
Ubuntu server + Samba + PAM + Apple OpenDirectory
Due to various reasons, we are looking to migrate our file servers from OS X Server 10.9 over to a true Samba implementation running on Ubuntu 14.04LTS. We have Ubuntu up and running with Samba ...
3
votes
0
answers
938
views
sshd on Fedora: Recent changes to UsePAM break existing security; PermitRootPassword & UsePAM no not honored, minimal PAM config doesn't work either
I did upgrade on a Fedora Server and was SHOCKED to discover thousands of root attacks on my publicly facing servers and I can't seem to figure out how to stop them!
To be clear; It IS possible to log ...
3
votes
1
answer
9k
views
id: user: no such user
I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
3
votes
0
answers
684
views
Must `kinit` user's ticket manually before PAM can mount SMB home directory at login
Ubuntu 14.04 file server
Ubuntu 14 Active directory (AD) server running Samba 4
Ubuntu 18 client (fresh install)
I've configured for Ubuntu user home directories to be mounted via PAM and SMB/CIFS.
...
3
votes
0
answers
4k
views
Local groups mapped to AD users via groups.conf working - but only with ssh login
I'm running a Samba Active Directory domain with Ubuntu 18.04 clients.
I used the /etc/security/group.conf file to successfully create a mapping for domain users to the "dialout" group. I tested it ...
3
votes
0
answers
2k
views
X11rdp/xrdp with aad-login -> pam authentication fails (xrdp_mm_process_login_response: login failed)
We are implementing a solution that allows users to login via aad-login (Azure Active Directory login) following this guide:
https://github.com/bureado/aad-login
Everything works fine - I can login ...
3
votes
0
answers
2k
views
Monitoring failed ssh logins with pam and bash?
I modified /etc/pam.d/common-auth to run a bash script when a login fails or when a login is successful and it works for successful logins but not failed login attempts when trying to ssh. Once I am ...
3
votes
0
answers
1k
views
Mac OSX - SSHD partially broken after El Capitan Upgrade
I recently upgraded my firm's Mac Mini device to El Capitan from Yosemite, and encountered several issues during the upgrade. I've gotten most of them resolved but one that's still failing is the SSH ...
3
votes
0
answers
682
views
PAM Google Authenticator With SFTP And Other Apps
I'm attempting to set up a situation where SSH Authorized Key + Google Authenticator Code is sufficient to ssh into the server.
This is working fine for normal SSH terminal operations - I'm prompted ...
3
votes
1
answer
2k
views
PAM Winbind Expired Password
We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted.
What's the ...
3
votes
0
answers
9k
views
User not recognized by underlying authentication
I'm running lxc on Linux Mint Debian Edition tracking Wheezy/Sid. I created a container using "lxc-create -t debian -n dev". In accordance with the Debian wiki article on LXC I have mounted the ...
2
votes
0
answers
397
views
PAM configuration popup yes or no for answer? after sudo apt install software-properties-common
I was trying to install the latest php version and after a command not found I googled it and they say to use the following command ''sudo apt install software-properties-common''
After doing this I ...
2
votes
0
answers
419
views
OpenVPN auth with Freeradius fails with error message: Module is unknown
I have installed an OpenVPN server with Easy-RSA. I generated the certificate and signed it on my CA Server and copied it back to VPN server. I can establish the client-server connection via ...
2
votes
0
answers
198
views
afpd[]: PAM audit_log_acct_message() failed: Operation not permitted
Im trying to debug this error in the /var/log/auth but I dont know where to look at.
Jul 27 06:44:30 server afpd[6463]: PAM audit_log_acct_message() failed: Operation not permitted
The syslog seems ...
2
votes
0
answers
3k
views
PAM: password authentication failed for remote user
I am executing a command from server1 which would do a remote ssh to server2 and execute certain commands as olcne user. I am seeing some exception in /var/log/secure file wrt to pam. Can someone ...
2
votes
0
answers
2k
views
Why all users are uid=0 when connecting through SSH?
I was testing some pam rules and I noticed that all users has uid=0 (root) when they log in to the system through SSH.
Could be a reason that sshd starts automatically when the server boots up? How to ...
2
votes
0
answers
2k
views
user pam.d configuration files to prevent updates overwriting them
My server is running and I have modified /etc/pam.d/common-password. When certain programs are installed or there are system updates, it needs to update that file so it asks me if I want to the file ...
2
votes
0
answers
468
views
User Resource management: cgroups + systemd + ssh
I am trying to limit the memory of a single user that keeps crashing our OpenSuse Server.
What I have done is as desribed here, to modify the limit of the user's slice via
systemctl set-property ...
2
votes
1
answer
222
views
Access of users using google-authenicator without token
I'm using google authenticator pam module on CentOS to create a 2FA authentication for my users, however, I want that only the users that have already registered with the authenticator are asked to ...
2
votes
1
answer
876
views
pam_winbind: unknown option require_membership_of
I'm trying to configure the VSFTPD with Winbind to restrict users authenticated by Active Directory, only to those that belong to specific group.
I'm using a generic conf file for the vsftpd, with ...
2
votes
0
answers
3k
views
All Free IPA clients unable to login
Environment:
~400 Servers enrolled in Prod IPA
Prod IPA setup as Master/Master replication between two servers
Around 4:40 PM yesterday users started reporting unable to login to servers via SSH. ...
2
votes
3
answers
4k
views
Google-authenticator with openvpn - AUTH: Received control message: AUTH_FAILED
I'm trying to set up MFA with Google authenticator for my OpenVPN setup on Ubuntu 16.04. Now OpenVPN works fine until I bring Google Authenticator into the mix.
My server.conf file reads as follows:
...
2
votes
1
answer
3k
views
sshd pam_ldap: ldap_simple_bind Can't contact LDAP server
Seen lots of similar post regarding my issue but none so far have really contributed to resolving the matter.
I have a bunch of old RHEL 5.5 servers which I need to authenticate against an LDAP ...
2
votes
0
answers
120
views
pam_afs_session: what does "PAG apparently lost" message in syslog mean?
We access our Debian Linux servers with ssh using GSSAPI. The servers run OpenSSH and take advantage of the pam-stack. In particular, they use pam_afs_session.
Every once in a while I see the ...
2
votes
1
answer
4k
views
Google Authenticator FreeRADIUS
I'm trying to implement google authenticator PAM module in FreeRADIUS on RHEL7.
I've loosely followed this guide: http://www.supertechguy.com/help/security/freeradius-google-auth
The reason I say ...
2
votes
0
answers
3k
views
pam_tally2 does not tally failed logins for failed SSH login attempts
Goal
For mobile devices we wish to add an extra layer of security by requiring a PIN code upon ssh login. Mobile access is only a convenience service (users can always pull out their laptops) and ...
2
votes
0
answers
14k
views
Unable to authenticate to AD using Kinit - cache file not found
I'm trying to set up Winbind with PAM and Kerberos to authenticate CentOS 7 against active directory.
So far this is what I've done:
yum -y install authconfig krb5-workstation pam_krb5 samba-common ...
2
votes
0
answers
691
views
SSH login with defined authentication methods
I have a small server, and I would like to be able to login using SSH with 2 methods:
Public key
Password and then a PAM made in Python
I successfully installed libpam-python, and added this line to ...
2
votes
0
answers
1k
views
Kerberos-based SSH login requires local user account
I've recently set up a linux system (Debian-Jesse) which has joined an MS-Based Kerberos domain and been set up to allow Kerberos-based authentication for remote access.
The only issue is, ...
2
votes
0
answers
3k
views
pam_sss(sudo:auth): authentication failure
I'm having some CentOS 7 machines joined a windows domain with the following steps:
#yum -y install realmd sssd oddjob oddjob-mkhomedir adcli samba-common
#nmcli c modify eth0 ipv4.dns 192.168.3.18
#...
2
votes
0
answers
765
views
LDAP Not working for SSH connections on ubuntu 12.04
Connecting from the client to the server:
$ ssh -vvv [email protected]
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: ...
2
votes
1
answer
652
views
vsftpd freezes after failed pam_script authentication
I have an Ubuntu 14.04 server with vsftpd and pam_script installed using apt-get. I've configured vsftpd to use pam_script for virtual user authentication and my /etc/pam.d/vsftpd file looks like this:...
2
votes
0
answers
767
views
How to add two-factor authetntication to ssh?
I am trying to add 2FA to sshd using PAM from oathtool package. I want two ways to login to server:
publickey and 2FA, or
password and 2FA
So far I managed to add 2FA to publickey authentication, ...
2
votes
0
answers
2k
views
How to mount share in pam_mount.conf.xml depending of OU
I have a Microsoft Windows domain and I want to add the ubuntu machines with Likewise-Open. There is no problem with that, but in my windows machines I have a GPO that mount a net share depending of ...
2
votes
1
answer
772
views
OpenLDAP on ArchLinux users cannot change passwd
I started an office and i NEED centralized login and home directories to work. Since all workstations are going to run Arch and problems with different LDAP versions I finally concluded the LDAP ...
2
votes
0
answers
688
views
Authentization agains Samba4 domain controler and not working kinit
I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
2
votes
1
answer
7k
views
How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?
Fail2Ban on Ubuntu 10.04
Configuration files
/etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1
bantime = 10 # made for test purposes
maxretry = 3
backend = polling
destemail = email@...
2
votes
0
answers
115
views
Set pam_unix password without knowing current password, having authenticated with pam_winbind
Right, so I have winbind authentication set up for login. However, I think there may still be some situations in which it would be useful for the user to be able to set their unix password (in the ...
2
votes
0
answers
416
views
pam_mysql / vsftpd error 'AUTHENTICATION FALURE (FIRST_PASS)'
I setup vsftpd and mysql auth via pam on Debian Squeeze.
Config:
auth required pam_mysql.so user=server passwd=x host=localhost db=server table=ftp usercolumn=username passwdcolumn=password ...
2
votes
1
answer
82
views
setting the "FROM" field in /usr/bin/w output
I'd like to set the FROM field in /usr/bin/w to various different strings that aren't my sshd's opinion of where the user has come from. Mostly this is because inbound ssh is often via on-host relays (...
2
votes
2
answers
2k
views
Add all network users to local group for specific hosts in CentOS7
How would I add a network (sssd-ldap) user to a local group?
More specifically, how can I add all network users who log into a system to a local group?
It doesn't look like authconfig has a setting ...
1
vote
0
answers
164
views
Can't authorise commands via tacacs+ server executed in shell by ssh
I've setup a tacacs+ server and a PAM tacacs client from here- https://github.com/kravietz/pam_tacplus/tree/main.
When user ssh into the tacacs client machine, I want authentication from tacacs+ ...
1
vote
0
answers
281
views
How to setup pam on debian 11
I have installed debian 11 and pam-ldapd.
Now, I want to setup authenticating for openvpn with pam. When I wanted to test it with 'getent passwd' command, I got only local users response.
Can you help ...
1
vote
0
answers
312
views
how to use PAM auth for ssh key clients?
How to unlock ssh private keys with PAM, so I can use fingerprintd module?
There are many questions here discussing PAM and kerberos for sshd auth, but I can't find anything on the client side.
Also, ...
1
vote
0
answers
702
views
Cron not working after pam customization to check groups
I need help with a PAM configuration.
I've a Debian 11.5 machine with kerberos connected to an MS AD server.
I want to configure the machine in order to allow some AD user to login, filtering them by ...