Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
0answers
102 views

Mounting EncFS with PAM at SSH login with password protected key

I'm running OpenSUSE 12.3 on a VM in the cloud and have an EncFS directory set up. I can mount it manually fine. I'm trying to have the directory mounted at SSH login, ideally only for the duration ...
0
votes
0answers
250 views

Netatalk authentication randomly fails over WiFi

Background info: I have an Ubuntu 12.04 server on which I have Samba (v3.6.3) and Netatalk (v3.1.0) installed. I use TimeMachine on my Mac to backup to the Ubuntu server over AFP provided by ...
1
vote
0answers
144 views

postgresql: invalid authentication method “pam”: not supported by this build

When I try to start postgresql 9.3.1 I receive this in startup log: # cat /var/lib/pgsql/pgstartup.log LOG: could not create IPv6 socket: Address family not supported by protocol LOG: invalid ...
1
vote
1answer
187 views

pam_cracklib reports bad password correctly but pam_unix module STILL changes the password

I am currently trying to use pam_cracklib which properly fails according to my debug.log but even though it is setup as a password requisite entry in my PAM config file, it still falls through to the ...
0
votes
2answers
509 views

ulimit -n not changing - values limits.conf has no effect

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. This question is somewhat of a follow up to this question. open file descriptor limits.conf setting ...
0
votes
1answer
143 views

Authenticate Radius user using pam and ssh [duplicate]

I am able to authenticate radius users using radius server+pam+ssh with creating local user with blank password in linux. Is it possible to authenticate radius users without creating users in local ...
0
votes
0answers
143 views

Pam password policy not working for root

I was following this guide (http://xmodulo.com/2013/12/set-password-policy-linux.html) for setting up pam and password for policy for CentOS. Everything works great except the root or any user's ...
0
votes
1answer
137 views

PAM exec stdout issue

I am having an issue with a dead simple python script; called with pam_exec. I added a line at the end of that file /etc/pam.d/common-session : session optional pam_exec.so /bin/python ...
1
vote
0answers
107 views

OpenLDAP on ArchLinux users cannot change passwd

I started an office and i NEED centralized login and home directories to work. Since all workstations are going to run Arch and problems with different LDAP versions I finally concluded the LDAP ...
0
votes
1answer
296 views

Can't login with KDM and SSSD but works fine from console

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically: Jan 9 ...
0
votes
1answer
101 views

OpenLDAP client configuration. Can search but cannot login?

I'm trying to set up LDAP on a Gentoo workstation to authenticate against a central server. However, I encountered some issues and I really hope you guys can help me out here :) First off, the LDAP ...
2
votes
0answers
180 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
1
vote
1answer
36 views

SSH listen on 2 ports, With a single config

Im trying to make SSH logins require 2 factor auth but only on one port. So port 1 is open only to a list of ip's managed by iptables. and only requires password / key port 2 is open to all, But ...
2
votes
3answers
458 views

How can I delay sshd login after bad password

How can I delay the retry response from SSH when a bad password is tried or unsuccessful login attempt. I wanted the delay to be 2-3 second more that usual. I could not find any option in ...
0
votes
0answers
38 views

How can I set path for non-interactive user authenticated using LDAP?

On a Mac running OSX 10.7.5, I need to set the PATH for non-interactive users who connect via ssh and are authenticated using LDAP. It's the same question that was asked (and answered) here: Updating ...
3
votes
1answer
216 views

How to use PAM to check LDAP password for some users, yet always use UID/GIDs from local files?

For a subset of my users in /etc/passwd, I would like to configure PAM (on Linux) to do the password checking part of the logon against an LDAP server, ignoring that these users are actually are ...
1
vote
2answers
3k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
1
vote
2answers
176 views

How does Cron interact with Kerberos for authentication?

I have a CentOS 6.4 machine which is set up with pam_ldap and pam_krb5. It is configured to use our Active Directory servers for authentication. I can SSH into the machine using AD accounts. I have ...
2
votes
3answers
279 views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
0
votes
0answers
119 views

How to ask memcached auth connection by sasl and pam?

I use memcached in a untrust network, so I try to use sasl and pam to auth connection to memcached. I installed sasl and pam module, compiled and installed memcached with sasl enabled. Also I created ...
1
vote
1answer
121 views

PAM Module works fine on i386 but fails on x64 when used in vsftpd

We have a custom PAM module that works fine on our i386 development machines but when we try and use it in production on our x64 production servers with vsftpd it fails. The PAM module has been ...
0
votes
1answer
131 views

AD Login to Solaris Zone Periodically Not Working

I have a Solaris 11.1 zone named "AZone". I have the zone joined to an Active Directory domain (Windows Server 2008) with the goal of users being able to use their AD account to log in to the Solaris ...
2
votes
1answer
205 views

PAM Winbind Expired Password

We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted. What's the ...
1
vote
1answer
72 views

PAM problems with “success=N” action

I want to run a script when an authentication failure occurs. But, with the following conf file, authenitcation always fails even when the proper credentials are supplied. auth [success=1 ...
1
vote
1answer
327 views

How to restore pam confiugration?

I did some modifications in "/etc/pam.d/common-auth , /etc/pam.d/common-account , /etc/pam.d/common-password , /etc/pam.d/common-session" files. Is there any way to restore default pam configuration?. ...
1
vote
1answer
80 views

SSH/ Telnet PAM configuration

How do I configure maximum number of login attempts before the session is dropped for SSH/telnet in PAM?
0
votes
1answer
104 views

Users Password does not reset after successful login at the console but works fine with SSH

The title says it all. I have my unsuccessful login attempts set to three. I purposefully fail logging in 2x, then when I SSH into the box successfully the 3rd time my count drops back to zero; ...
1
vote
1answer
3k views

ssh: “Access denied by PAM account configuration” for one non-root user but not another

On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is ...
0
votes
0answers
114 views

How to allow the root user to change LDAP password for normal users?

I have a LDAP-Server that is running on Debian 6.0.7 Squeeze. The LDAP-Server is used for the user authentication and the sudo management of all other virtual servers in our network. On a Debian 7 ...
0
votes
0answers
34 views

first login/password change ldap -> call script on local machine

i have machines which authenticate against openldap using pam_ldap. I would like to be able to call shell scripts somehow (to update services which don't integrate with ldap) (which should be ...
3
votes
2answers
432 views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
1
vote
1answer
50 views

Limiting login via access.conf not working

I'm running Debian Wheezy and having a rough time getting /etc/security/access.conf changes to apply. Tangentially, I believe there could be an issue with PAM in general as I have been unable to get ...
0
votes
1answer
99 views

system authentication and radius authentication

I am using CentOS 6.3 and want to enable ssh RADIUS authentication along with Centos system Authentication. Right now my server is firstly authenticated with RADIUS server. And after system ...
0
votes
1answer
205 views

PAM: auth: pam_unix(dovecot:auth): authentication failure;

We have opnldap setup on our ubuntu server, and were getting this message for a user: auth: pam_unix(dovecot:account): account has expired (account expired) Sep 3 19:05:03 auth: ...
3
votes
1answer
340 views

How to make exception in password locking via pam_tally2 for specific user?

I need to make an exception for a specific user, so that his failed logins are not counted by pam_tally2, and well, this is not a root account (I'd use magic_root then). Is it doable?
0
votes
0answers
35 views

pam_ldap error (saslauthd)

I have a ton of the following Invalid credential errors in /var/log/messages but not sure where or how to troubleshoot Aug 26 14:52:53 hostname01 saslauthd[2756]: pam_ldap: error trying to bind as ...
1
vote
1answer
65 views

Disable hostname resolution in PAM

When authenticating using PAM, PAM exposes the remote host to the module. On the code side of things, it exposes this via PAM_RHOST using pam_get_item(). However, PAM will attempt to resolve the IP ...
0
votes
1answer
191 views

Strange Change in ssh behavior + LDAP

We have a cluster with a front node that admits normal users and LDAP users. Two days ago the ssh show a strange behavior: The LDAP users can't login in the front node using password but, The LDAP ...
1
vote
3answers
2k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
2
votes
1answer
2k views

What is nsswitch compat mode?

Red Hat recommended me compat mode in /etc/nsswitch.conf as one of the options to enumerate LDAP users, but later said that it's not a much-used method. nsswitch.conf passwd: files compat ...
0
votes
1answer
85 views

What are disadvantages of using nsswitch compat?

In my current LDAP set-up "getent passwd" shows all 600+ users that exist in the LDAP, not enumerating only the 20 LDAP-users that have permission to access this netgroup/server. This can be solved ...
6
votes
1answer
244 views

Need help understanding PAM directives

I have the following directives in my /etc/pam.d/sshd file on a RHEL5 box and I'm a bit confused. These directives are there to make LDAP+RADIUS+OTP work. What I'm trying to do is tell pam not to ...
2
votes
1answer
286 views

How can I limit failed sasl2/pam_mysql login retries?

I have Postfix setup serving multiple virtual domains on a CentOS box - and all works as expected. Client's login are authenticated through sasl2 (saslauthd) and pam_mysql. And when a login attempt ...
0
votes
0answers
56 views

vsftpd with pam_mysql, getting the home dir from a table field

I'm currently migrating an existing ProFTPD setup to vsftpd + pam_mysql, while keeping the existing database that ProFTPD currently uses. I've already successfully set up virtual user authentication ...
1
vote
2answers
132 views

How can I allow users to change their local passwords?

We use an LDAP-server, but we also use local accounts. [jdoe@tst-03 ~]$ passwd Changing password for user jdoe. Changing password for jdoe. (current) UNIX password: Enter login(LDAP) password: This ...
0
votes
1answer
112 views

LDAP queries for local users

Recently, in the company where I work, we have had a general system crash and we are figuring out the causes. Our machines are configured for LDAP authentication plus some local users in some of them. ...
0
votes
0answers
164 views

pam-auth-update without the text UI

Is there a way to run pam-auth-update (or some equivalent command), non-interactively on Ubuntu 12.04. I'm trying to automate this process for a number of machines, and the curses interface is making ...
1
vote
1answer
106 views

vsftpd + vitual users + selinux

I can't make vsftpd to work and it is driving me crazy. The virtual users can connect, but they can't upload files or create folders. I hope someone can help me. I get this error in the ftp client: ...
0
votes
2answers
206 views

PAM LDAP configuration for non-local user authentication

I have a requirement to allow non-local user accounts to be logged in via LDAP authentication. Meaning, the user that is trying to login is allowed access, if the user account exists in LDAP server ...
3
votes
3answers
141 views

Is there a command line two-factor authentication verification code generator?

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup ...