Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
0answers
58 views

pam_access nisnetgroup with nested posixgroup

We have pam_access enabled and correctly allowed/denying users based on the rules in place. One such rule looks up LDAP backed NIS groups + : @hostname-granted : ALL Putting tuples in ldap work for ...
5
votes
5answers
196 views

Filter LDAP user through PAM so it appears to not exist at all

In our corporate environment long ago some wiz decided to put the user "mysql" into LDAP. The account is disabled: $ sudo su - mysql This account is currently not available. ...but it's id still ...
1
vote
0answers
88 views

PAM Google Authenticator With SFTP And Other Apps

I'm attempting to set up a situation where SSH Authorized Key + Google Authenticator Code is sufficient to ssh into the server. This is working fine for normal SSH terminal operations - I'm prompted ...
0
votes
1answer
48 views

PAM standard macros and logging on CentOS7

According to the D(x) macro defined in pam_macros.h (source code) and used as follows: D(("Hello PAM World")); Where is this log located on CentOS7? Note that I am using as flag debug in my pam.d ...
0
votes
2answers
116 views

/var/log/secure reporting false positives

I have my CentOS 6 system configured to use sssd with ldap provider. I am able to login and use sudo, however /var/log/secure always reports authentication failure: Sep 18 07:09:52 serverA sudo: ...
0
votes
0answers
15 views

password changed by poppassd doesn't reflect smbpasswd

I have installed poppassd and coded a php script for users to change their passwords via web. However I noticed that what being changed via poppassd did not reflect users' samba password. Any pointers ...
1
vote
1answer
223 views

inactive option not working for pam_lastlog.so

I'm trying to set up my system to lock out inactive users after 10 days. I'm using CentOS 6.x, and looking at RHEL manual, this is what I found: To lock out an account after 10 days of inactivity, ...
2
votes
0answers
274 views

Ldap client on CoreOS

Has anyone setup ldap on CoreOS before? If so, how does one do such a task? I have a cluster of CoreOS machines and I'm trying to hook up this service Foxpass https://www.foxpass.com/ to it for user ...
0
votes
0answers
42 views

Can't setup mount of EncFS on user login

I've tried to setup EncFS to be mounted on user login as described in this guide excluding the Password Utility section, however it works with little success. The EncFS works properly ...
1
vote
2answers
90 views

Postfix omits realm (@domain) when checking for smtpd pam+mysql authentication

I've trying to configure Postfix so users can send email through SMTP having a username and password. And I'm trying to store credential within a MySQL database. I've taken the path of saslauthd and ...
15
votes
1answer
3k views

Slow ssh login - Activation of org.freedesktop.login1 timed out

On one of my servers I've noticed really delay on SSH logins. Connecting using the ssh -vvv options the delay occurs at debug1: Entering interactive session. extract of connection: debug1: ...
0
votes
1answer
179 views

pam google authenticator can't compute location of secret file

I've installed Google Authentication on all the machines in our system, and while the authentication during login works fine, our machines are producing logs that have this line over and over: ...
0
votes
0answers
120 views

how to get my kvm-nodes monitored by the opennebula-server

I just set up an OpenNebula server with the oned running. I also set up a kvm-node to deploy virtual machines on. When I tried to add the kvm-node to the OpenNebula server with onehost create ...
2
votes
1answer
574 views

cannot login via ssh

Can not login to SLES server via ssh as user1. At the same time I can login as root user without any problem. Authentication method is password based. In /etc/ssh/sshd_config I have ...
0
votes
0answers
162 views

centos7 pam_authz_search for *.group.company.com

Upgrading from Centos6 where we were using ldap.conf entry "pam_check_host_attr=yes" previously, with wildcard 'host' attribute in ldap where the host attribute looked like 'host=*.group.company.com' ...
1
vote
0answers
165 views

SSO Linux and AD Trusted Domain

Having successfully built a one-way trust between 2 AD domains, we can't lookup/id the user in the trusted domain. Here's our use case. AD1: dom1.com (Win2k8 R2) - One-way outgoing trust to AD2 ...
1
vote
2answers
791 views

pam_limits: Operation not permitted for sshd

Debian 8.0, pam 1.1.8-3.1, sshd 1:6.7p1-5. I'm trying to permanently increase the maximum number of open files. In /etc/pam.d/ I've got: /etc/pam.d# grep pam_limits.so * atd:session required ...
1
vote
1answer
53 views

How does pam_limits decide on the default limits?

In a linux system that is using the pam_limits module, but has nothing configured in /etc/security/limits.conf (or /etc/security/limits.d/*) how does pam_limits decided on what limits to implement?
3
votes
1answer
117 views

ssh as user runs program with no authentication (neither password nor keys)

I'd like to set up a user on my system (Ubuntu 14.04 x64) such that people can run ssh example@myhost.example.com and see some output from a program without being prompted for a password or having to ...
1
vote
0answers
64 views

Ubuntu 14.04 “azureuser” exists - and I did not create it

I just logged into an Ubuntu 14.04 instance and in the home folder there is a user "azureuser" (yes, this is an Azure VM) with four items in it: .ssh (folder) .bash_logout (file) .bashrc (file) ...
2
votes
0answers
313 views

LDAP Not working for SSH connections on ubuntu 12.04

Connecting from the client to the server: $ ssh -vvv user@10.0.50.170 OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 debug1: Reading configuration data /etc/ssh_config debug1: /etc/ssh_config line 20: ...
3
votes
1answer
369 views

LDAP authentication fails

I try to set up an LDAP directory that will allow me to authenticate Debian users. Once the configuration of the LDAP server and PAM files is done, the authentication fails. I think the client doesn't ...
1
vote
0answers
22 views

The differences between libpam-ldap and libpam-ldapd, included packages and modules? [duplicate]

May I ask what's the differences between libpam-ldap and libpam-ldapd when it comes to included packages and modules? As i understand is nss-pam-ldapd the project of libpam-ldapd, which is an ...
1
vote
0answers
54 views

Remote home-folders with optional but preferred locally-encrypted folder

I have the use case that on default all users are working within remote mounted home directories. However, sometimes they prefer a local home on one or more machines, e.g. because the network is too ...
2
votes
2answers
749 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
2
votes
1answer
133 views

SSHD applying different PAM rules for localhost connections

I am attempting to implement Yubikey auth via SSH. I've edited my /etc/pam.d/sshd file as follows, and it seems to work while connecting locally (ssh user@localhost): #%PAM-1.0 auth required ...
1
vote
0answers
78 views

How to properly automount tmpfs inside encrypted home folder on login?

I have a user with encrypted home folder which is automounted on login with pam_ecryptfs module. I would also like to have several folders automounted as tmpfs using local configuration file from ...
-1
votes
1answer
260 views

Curious what server pam_pwdfile is in var/log/messages

I am getting tons of these messages in my /var/log/messages file Apr 16 06:58:20 server pam_pwdfile[7856]: couldn't open password file /etc/techproxy.shadow Apr 16 06:58:20 server pam_pwdfile[7863]: ...
0
votes
2answers
79 views

Disable ssh login on specified time for particular users

I would like to disable ssh login to my system for particular users say X,and Y on specified time 17.00 to 18.00. so how to achieve this ? any help would be appreciated.
2
votes
1answer
530 views

Is it possible to ignore a missing PAM module?

I am configuring yubico-pam to enable passwordless sudo access using challenge-response from a Yubikey. The following works: # /etc/pam.d/sudo auth sufficient pam_yubico.so ...
1
vote
1answer
170 views

How can I change the directory in wich pam_mkhomedir creates the user's home directories?

I am using pam_mkhomedir to automatically create user's home directories when they first log in. However, the home directories are created inside the /home directory, while i need them to be created ...
14
votes
2answers
2k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
1
vote
1answer
560 views

Check if account is allowed when using pam_access

I'm using pam_access and /etc/security/access.conf to restrict who can login to my Rhel 6.5 hosts. I have an LDAP server with a diverse user base, and the security people would like a list of who can ...
0
votes
1answer
709 views

migrate samba users to new server

I've read How to migrate Samba User Accounts to a new linux server? however it doesn't address my situation, or at least not with a solution. I have a RHEL 5 machine, wood, running Samba, Dovecot, ...
4
votes
1answer
46 views

Use more complex AND/OR structure with PAM

PAM allows to use sufficent and required for some logic, like auth sufficient pam_a.so auth required pam_b.so auth required pam_c.so which would mean "either a is true, or b must be true and then c ...
0
votes
1answer
462 views

Unable to authenticate LDAP client with PAM when pwdReset = TRUE

I have searched tons of webs and tutorials but I couldn't find an answer to my problem. I have set up OpenLDAP 2.4 on a OpenSUSE 12.3 machine with a password policy overlay. The client is a Linux ...
1
vote
1answer
5k views

Fedora 21 pam_sss authentication failure - permission denied

We have configured a OpenLDAP server which is working fine. FreeBSD, Debian, and a WordPress plugin authenticate with no problems. We are configuring Fedora 21 with pam_sss, but we get the following ...
0
votes
1answer
452 views

tacacs+ for Linux authentication/authorization using pam_tacplus

I am using TACACS+ to authenticate Linux users using pam_tacplus.so PAM module and it works without issues. I have modified the pam_tacplus module to meet some of my custom requirements. I know by ...
1
vote
2answers
616 views

How to filter ldap user logins on linux?

I have several linux servers (ubuntu 12.04) setup to authenticate user logins over an external (to my branch office) LDAP (Novell Edirectory specifically). This is working well, however I am trying to ...
1
vote
1answer
92 views

What's the downside of disabling PAM in OpenSSH if only public-key login is allowed?

/etc/ssh/sshd_config by default has the following line UsePAM yes I read through available documentation and came to the conclusion that PAM is not used if I only use public-key login. What ...
2
votes
1answer
205 views

vsftpd freezes after failed pam_script authentication

I have an Ubuntu 14.04 server with vsftpd and pam_script installed using apt-get. I've configured vsftpd to use pam_script for virtual user authentication and my /etc/pam.d/vsftpd file looks like ...
0
votes
0answers
113 views

ProFTPd won't allow me to log in after password change

I've changed a password for one of my users (using passwd username), and now ProFTPd won't allow that user to log in. Other users can still log in as normal. I'm running Ubuntu 14.04 LTS The error ...
0
votes
1answer
695 views

pam_mount not working when logging in from ssh or console

okay so i configured pam_mount on my centos 6 machine as i did on my centos 7 and 5 machines. But when i login locally or via ssh, pam_mount can't mount my home dir. when i login with a local user, ...
2
votes
1answer
706 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
1
vote
1answer
357 views

How to override a user's UID coming from an LDAP directory?

I am trying to setup Linux logins for users in an LDAP directory. The directory contains users which have a UID under 1000 and I believe this is causing problems with logins to those accounts as UID ...
1
vote
1answer
143 views

Can I configure pam_ldap without configuring nss?

On my servers I have my system users provisioned with Chef and have no desire to expose any additional users to these machines. I would however like to utilize pam for the authentication backend for ...
2
votes
2answers
964 views

Debugging a Postfix Saslauthd PAM-PGsql authentication failure

I've set up pam-pgsql to lookup passwords in my database for Postfix via Saslauthd. I can test credentials using the command line: $ sudo testsaslauthd -u user@email.com -p password 0: NO ...
0
votes
2answers
1k views

sendmail & sasl auth on CentOS 6

I'm moving a mail server from one CentOS 6 to another. I use sendmail with sasl pam authentication. When I try to send mail it fails because the user is not authenticated and the mail client does not ...
3
votes
2answers
3k views

Join Red Hat Linux 6 to a Windows Active Directory Domain

I am using Red Hat 6 (for testing purpose) and configure samba with active directory.Red Hat 6 has successfully join with my windows server 2003 domain. By typing the command [root@mainserver /] # ...
0
votes
1answer
544 views

pam_mount on centos won't mount cifs

so I have this problem that pam_mount won't mount my cifs home dirs pam_mount has this in /var/log/messages: Feb 3 15:49:18 centosy nslcd[1278]: [3c9869] <passwd="tomas"> (re)loading ...