Questions tagged [pam]
Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.
757
questions
1
vote
0
answers
746
views
Using ssh with sssd for password or publickey and extending with MFA support through PAM
So after some extensive testing and discussing I can no longer wrap my head around this problem on my own.
Goal: Authenticating over ssh with either publickey or password, and use PAM for MFA.
System ...
- 11
0
votes
0
answers
441
views
SSSD alternative for pam_authz_search option in nslcd
I have servers based on RHEL 7 and 8.
RHEL 7 serevers use nslcd to work with a LDAP server, RHEL 8 use SSSD.
For RHEL 7 I can provide access for users to allowed hosts only.
This functions is covered ...
- 578
0
votes
1
answer
1k
views
Problems sudoing using a host connected to Active Directory (sssd, kerberos local sudoers file)
I am configuring Active Directory authentication for an Alma 8 box using SSSD, Kerberos, and initial SSH key for log in stored in an Active Directory object, and a local sudoers file that lists groups ...
- 109
1
vote
1
answer
7k
views
LDAP finds user, but "permission denied" when logging in
I am setting up an LDAP client in Red Hat 8.
After setting up the config files I did an LDAP user test and it came back successfully:
# id myusername
uid=666(myusername) gid=510(active_users) groups=...
- 121
1
vote
1
answer
507
views
Enforcing 2FA configuration on next SSH login for every user
I have found numerous tutorials on how to enable 2FA (TOTP, RFC 6238) but is there also a way to force SSH users to configure it on the first login? (I am using OpenSSH server)
I guess I could create ...
- 65
2
votes
1
answer
556
views
SSH authentication: (public key xor password) + google authenticator code
I'm using Debian bullseye. I'm trying to set up SSH two types logins:
password + code from Google's Authenticator (if user set it, "nullok" option),
public key + code from Google's ...
- 21
0
votes
1
answer
261
views
PAM permit works only when dummy suffix is added
I am trying to use PAM to authenticate OpenVPN against 2FA (not important info). Here is my PAM configuration:
account required pam_permit.so
auth required pam_google_authenticator.so ...
0
votes
1
answer
746
views
Apple client unable to login with LDAP backend and GSSAPI or PLAIN
I have a OpenLDAP server with Kerberos5 for authentication and on Linux/Unix/Windows environments I am able to login without a problem.
The LDAP server is configured to use GSSAPI or PLAIN that passes ...
0
votes
0
answers
219
views
Account locking without bad password pamd ssh
Here is my password-auth file:
auth required pam_faillock.so preauth silent deny=5 unlock_time=900
auth required pam_faillock.so authfail deny=5 unlock_time=900
auth ...
- 101
1
vote
0
answers
378
views
Modern alternative for pam_userdb (for use with vsftpd)
Quite some years ago, I setup a vsftpd server with virtual users, according to some howtos (still) to be found on the internet, using pam_userdb.
Like this: A file called /etc/pam.d/vsftpd.virtual:
#%...
- 171
0
votes
0
answers
730
views
CentOS 7 PAM / LDAP SSH/LOGIN user does not start in his home directory
On a CentOS 7 machine, users can use their LDAP credentials to connect to my servers.
The first time they do this, the pam_mkhomedir is doing its job well. The user's folder /home/jdoe is well created ...
- 15
0
votes
1
answer
2k
views
CRON[83463]: Failure setting user credentials
I have a number of docker containers, all set up mostly identically, which successfully use cron to run nightly backup jobs.
I have another container, set up mostly identically, which tries, and fails,...
- 348
1
vote
0
answers
104
views
Authenticating ftp against multiple (postgres) databases
Current State
Given is a host with a couple of IPv4 addresses and HTTP & FTP access for each address; each vhost has access to a PostgreSQL database. Web- and ftp-authentication is done against ...
- 11
0
votes
1
answer
854
views
How to give web server user read permission to /etc/shadow file?
I would like to have a local Linux user to be able to be authenticated (login) using the Nginx PAM module. I am using a CentOS 7 server. Specifically the below is what I am trying to do...
The README ...
- 21
2
votes
1
answer
1k
views
How to authenticate local Linux user with Nginx PAM module?
I would like to be able to have a local Linux user authenticate with their credentials when accessing a site. I am using the ngx_http_auth_pam_module. In the nginx.conf file I have the following ...
- 21
6
votes
2
answers
4k
views
SSH public key authentication with google authenticator still asks for password
I'm trying to enable 2FA with ssh using libpam-google-authenticator. Not all users need authenticator enabled. Everybody uses ssh public keys, and nobody has a password. I'm running Debian buster, and ...
- 211
1
vote
0
answers
41
views
SOCKS_dante(1.4.3)_Separate processing by port number
I have installed dante and it is working fine. In addition, I want to divide the process according to the port number of the client, but it doesn't work.
I want to divide the processing as follows.
...
- 11
0
votes
1
answer
1k
views
/etc/login.defs settings not taken into account: password aging
The following is done on a Ubuntu 20.04 system.
This is the scenario where I am facing an issue:
I edit the password aging settings in the login.defs file
Then I change the password of the user with ...
- 148
0
votes
1
answer
1k
views
postfix/sasl/pam (mysql) auth error
I've followed tutorial on http://flurdy.com/docs/postfix/ to set up an email server, and most of it works (after switching from Courier to Dovecot). Just not sending email through SMTP. Sending with ...
- 347
1
vote
0
answers
3k
views
How does the sudoers option 'pam_session' correspond to PAM's 'session' type?
On a CentOS 7 system, I want to prevent lines such as
May 20 08:55:05 c090 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
May 20 08:55:05 c090 sudo: pam_unix(sudo:session): ...
- 242
0
votes
0
answers
155
views
crond not loading /etc/pam.d/crond config
I have this PAM config in /etc/pam.d/crond:
auth required pam_env.so user_readenv=1
And this .pam_environment file:
_APP_PASSWORD DEFAULT=foo
And this test cronjob:
*/1 * * * * root env 2&>1 |...
- 433
1
vote
0
answers
199
views
CentOS USER_CMD logs auditd
We are trying to start logging all executed commands by users (including root) on CentOS using auditd with type=USER_CMD, how we can do it?
We already getting commands, starting with sudo, but not ...
3
votes
0
answers
972
views
sshd on Fedora: Recent changes to UsePAM break existing security; PermitRootPassword & UsePAM no not honored, minimal PAM config doesn't work either
I did upgrade on a Fedora Server and was SHOCKED to discover thousands of root attacks on my publicly facing servers and I can't seem to figure out how to stop them!
To be clear; It IS possible to log ...
- 1,262
4
votes
1
answer
1k
views
What is the easiest way to set up composable POSIX groups for SSH & Samba authentication?
Background
I'm putting together what I would consider to be a fairly ordinary chunk of infrastructure, but have been running into so many problems that I can't help but wonder if there's an easier way....
- 266
0
votes
1
answer
1k
views
What causes - Error: pam...Multiple password values not supported?
On a linux server a user is unable to collect email using Microsoft Office. in /var/log/maillog I see this
Mar 1 20:49:48 nitrogen dovecot: auth-worker(15749): Error: pam([email protected], 1.2.3.4,&...
- 126
1
vote
0
answers
407
views
How to customize NSS filters to match users against several attributes?
My context: I have a OpenSMTPD instance that uses PAM as its authentication backend. My PAM configuration use NSS to authenticate the users against a LDAP directory.
I would like to make NSS match ...
- 195
3
votes
1
answer
3k
views
configure saslauthd with PAM
I'm trying to configure saslauthd with PAM. I created a user test with password test using useradd and passwd and I checked that I can login with su - test.
[arch@vps-5220ce87 ~]$ systemctl status ...
- 151
3
votes
1
answer
9k
views
id: user: no such user
I'm using Centos 7 to authenticate locally Active directory users using kerberos. I joined the realm with the Administrator and i can login/ssh through it/with it, nslookup working fine, and adcli ...
- 31
0
votes
1
answer
410
views
PAM in Linux: any way to skip local auth if remote/external auth DB returns a negative response?
Dear fellow system tinkerers,
an admin friend has asked me the following question:
On a number of network elements and servers, he's using remote authentication against a TACACS+ server. On some such ...
- 271
0
votes
0
answers
81
views
Custom bash prompt failing when home directory is remote
0
I am trying to configure a custom prompt for RHEL 8 users. It works very nice when the users have local home directories.
However, I'm mounting home directories via pam_mount (nfs4). When ssh'ing to ...
- 200
1
vote
0
answers
57
views
HTTPD with SSL startup fails with missing PAM library error
I am configuring SSL to run with Apache 2.4 on RHEL7. As expected, httpd starts successfully before SSL configuration is added. After adding certificates and configuration files, startup fails with ...
- 11
0
votes
0
answers
942
views
pam_tty_audit collect only TTY events
I'm trying to put together a TTY logging feature under Ubuntu 18.04 server and created /etc/pam.d/tty-audit with the following content:
session required pam_tty_audit.so enable=*
and added that ...
- 3
0
votes
0
answers
1k
views
LDAP, NSLCD, and PAM Auth; Debian 10
I may be looking in the wrong place, and if so let me know and I'll find the correct place.
I've been struggling with the issue for the past week or so in my homelab set up. I followed the ...
1
vote
2
answers
288
views
Why can users just not login with SSH while everything else seems to work?
I have set up a pair of OpenLDAP servers on Ubuntu 20 with directional failover using Syncrepl. Things that an LDAP user can successfully do include:
login
su - <uid>
remote bind from ...
- 165
0
votes
0
answers
68
views
Linux pam_time with groups [duplicate]
How do I allow /etc/security/time.conf to be able to restrict groups instead of users?
It works flawlessly with users but not with groups. I need to have multiple groups in my case.
- 1
1
vote
1
answer
981
views
PAM authentication - automatically create user?
I've finally got LDAP auth working on Ubuntu 18.04, however it only works if I first create the local user account (eg john.smith).
If I don't create the account first, it fails to bind to the LDAP ...
- 11
1
vote
1
answer
305
views
Google Compute - CentOS 8 PAM Authentication Fails After Update
I have a Google Cloud project on which I'm unable to access a CentOS 8 VM. It is running kernel version 4.18.0-193.19.1.el8_2.x86_64 on an x86_64. I'm also running with selinux enabled.
Before running ...
google-compute-engine
0
votes
1
answer
535
views
How to install pam_mount on RHEL 8?
I'm trying to install pam_mount on RHEL8 but keep getting this:
rror:
Problem: package pam_mount-2.16-10.el8.x86_64 requires hxtools, but none of the providers can be installed
- conflicting ...
- 200
1
vote
0
answers
186
views
Accessing KRB5CCNAME from /etc/gdm/PreSession/Default on RHEL8
I would like to run a script after a user login. This script, using his kerberos tickets, will mount an SMB share.
Under RedHat 7 I could simply call the script from /etc/gdm/PreSession/Default and it ...
- 200
5
votes
2
answers
6k
views
cgroup fork rejected by pids controller
Have a small server program written in C/C++ that uses nginx and Postgres, currently all are hosted on the same ubuntu system. I usually run the server program from the bash command line.
Recently on ...
- 191
0
votes
1
answer
129
views
Let one user become another user without a password?
On (most) Linux systems, we can let a specific user su into anyone they want by placing him in the wheel group and making some settings in /etc/pam.d/su.
I want to do something more limited: I want to ...
- 1,722
0
votes
1
answer
785
views
Why does Alpine-based sshd shut down when first session ends?
I have a simple Docker container for a purposeful sshd server whose image derives from alpine:latest. It currently uses /usr/sbin/sshd -D -e -ddd as its entrypoint. When I ssh into it for running a ...
- 377
2
votes
0
answers
427
views
OpenVPN auth with Freeradius fails with error message: Module is unknown
I have installed an OpenVPN server with Easy-RSA. I generated the certificate and signed it on my CA Server and copied it back to VPN server. I can establish the client-server connection via ...
- 1,675
2
votes
0
answers
202
views
afpd[]: PAM audit_log_acct_message() failed: Operation not permitted
Im trying to debug this error in the /var/log/auth but I dont know where to look at.
Jul 27 06:44:30 server afpd[6463]: PAM audit_log_acct_message() failed: Operation not permitted
The syslog seems ...
- 33
-2
votes
2
answers
77
views
Is using easy passwords on root account safe? [closed]
Now that I've got your attention :)
This is more of a thought experiment than a real question
I've been thinking about using an easy root account password for recovery purposes, having in mind these ...
0
votes
1
answer
547
views
Errors log in the auth.log but all working fine
Hi I have a Linux server (18.04) that acts as a TimeMachine backup server using the netatalk service.
The users are authenticating using the LDAP (/etc/ldap.conf)
The client can connect to the AFP ...
- 33
2
votes
1
answer
2k
views
OpenVPN with PAM with systemd and SELinux
I am trying to set up an OpenVPN (2.4.9) server with PAM login on CentOS 8.2 and I am facing some strange issues.
Specifically, i can successfully athenticate if I start the server with the ExecStart ...
- 51
0
votes
0
answers
3k
views
How to enable pam and disallow root/password login for ssh?
I want do disable password and root login via ssh. I followed this guide https://www.cyberciti.biz/faq/how-to-disable-ssh-password-login-on-linux/. It suggests making the following changes to /etc/ssh/...
- 101
0
votes
1
answer
679
views
libpam-ldap unable to connect to LDAP server over SSL/TLS
I am trying to configure PAM to work with my LDAP server for authentication. To do this I am trying to use libpam-ldap, I decided to use libpam-ldap instead of libpam-ldapd for two reasons. First, ...
- 101
0
votes
1
answer
1k
views
sshd fails to login user
I could not ssh into one of my servers this morning after successfully doing so most recently yesterday.
ssh hostname
Connection closed by hostname port 22
I rebooted system and it did not fix the ...
- 206