Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

4
votes
2answers
195 views

AWS Simple AD: “KDC has no support for encryption type” for users created with adtool, but not with MS Management Console

Background I am trying to log in (via SSH, to an Amazon Linux EC2 instance running sssd) as users that I've created in my AWS Directory Services Simple AD. I am authenticating with kerberos and ...
2
votes
1answer
81 views

SSH, Kerberos, AD: how / where to config /etc/pam.d/password-auth?

I have a CentOS 6 machine here and want to give SSH access for users from another forest, which is trusted. I got a temporary workaround, which is: 1) change content in /etc/pam.d/vncserver to auth ...
2
votes
1answer
54 views

OpenLDAP - How to restrict Debian login to specific groups (posixGroup)?

I'm trying to restrict login to specific LDAP groups in Debian 8. The system is configured to use OpenLDAP (PAM) as authentication method. My goal is to configure the system to allow all local users ...
0
votes
0answers
96 views

Problems using SSH with winbind authentication

I am trying to set up authentication against an Active Directory Server on a Debian Wheezy machine. So far, getent passwd/group works perfectly and shows me the network users/groups. wbinfo -u/-g ...
0
votes
2answers
323 views

login with active directory users on debian jessy not working

I'm trying to get the login with active directory users working for nearly a week now. First of all, I'm pretty new to pam, samba, kerberos and winbind. We worked with local users and sudo before, but ...
6
votes
2answers
246 views

Unable to login via PAM and ldap: failed to get password

I'm trying to have OpenVPN authenticate users via PAM over LDAP to an Active Directory server. Here are the relevant parts of my configuration files: /etc/openvpn/server.conf: # ... plugin /...
0
votes
1answer
63 views

Authentication based on any of the PAM module

I want to allow some users to only use SFTP but not SSH. Also I dont want these SFTP users ID and password to be stored in /etc/passwd file. I want their id and password details will be stored in a ...
3
votes
1answer
72 views

Kerberos authentication fails when local password is expired

I am using pam_krb5 with local accounts (Linux) for AD password authentication. Things are working great, users are able to authenticate with both AD and local passwords. I am having a problem though,...
0
votes
0answers
92 views

How to set up libreswan with PAM and Google-authenticator for Mac Clients

I can't seem to get xauthby=pam working. I recompiled libreswan with PAM support. The VPN server does work when I set it up to use chap so I know the server is largely set up right. I'm following ...
1
vote
1answer
164 views

PAM with LDAP and add an exception for local user

I've successfully configured LDAP and SSH. Also I've added a requirement that user should be in admin group. That works. /etc/ldap.conf ... pam_groupdn cn=admin,ou=Groups,dc=example,dc=com ... /...
0
votes
1answer
101 views

SSH/SFTP to Centos 7 from Coda

I am running a droplet on DO with Centos 7 - from my mac terminal I can login as root (with password) without any problems. But if I try the same from Coda (editor) I run into problems. My audit log ...
1
vote
0answers
297 views

How to use SHA-256 hashed (and salted) passwords from OpenLDAP in pam_ldap?

I have hashed and salted passwords in OpenLDAP for login via PAM in Linux. The setup works when the hashes are of type SHA-1 (salted or unsalted) or plain text. In these cases everything works fine ...
0
votes
0answers
106 views

CentOS7 ldap client not authenticating with ldap server

I am using ApacheDS which was a breeze to setup thanks to the apacheds mailing list. I am able to retrieve ldapsearch results, however, I am not able to get anything by doing a:"getent passwd ". [...
0
votes
0answers
82 views

PAM - Ignore local user, if LDAP-connection works

I have configured some SLED10SP1 (not allowed to update) machines to use LDAP for user authentication. Because SLED10 doesn't have official packages for pam_ccreds or sssd, I have to find a way to ...
1
vote
1answer
379 views

SSH Authentication using RADIUS + Google Authenticator

I'm trying configure my SSHD's to authenticate users using FreeRadius. The FreeRadius server needs to first require a valid OTP using Google Authenticator, and then verify the system account password. ...
0
votes
0answers
65 views

pam_access nisnetgroup with nested posixgroup

We have pam_access enabled and correctly allowed/denying users based on the rules in place. One such rule looks up LDAP backed NIS groups + : @hostname-granted : ALL Putting tuples in ldap work for ...
5
votes
5answers
211 views

Filter LDAP user through PAM so it appears to not exist at all

In our corporate environment long ago some wiz decided to put the user "mysql" into LDAP. The account is disabled: $ sudo su - mysql This account is currently not available. ...but it's id still ...
1
vote
0answers
96 views

PAM Google Authenticator With SFTP And Other Apps

I'm attempting to set up a situation where SSH Authorized Key + Google Authenticator Code is sufficient to ssh into the server. This is working fine for normal SSH terminal operations - I'm prompted ...
0
votes
1answer
54 views

PAM standard macros and logging on CentOS7

According to the D(x) macro defined in pam_macros.h (source code) and used as follows: D(("Hello PAM World")); Where is this log located on CentOS7? Note that I am using as flag debug in my pam.d ...
0
votes
2answers
127 views

/var/log/secure reporting false positives

I have my CentOS 6 system configured to use sssd with ldap provider. I am able to login and use sudo, however /var/log/secure always reports authentication failure: Sep 18 07:09:52 serverA sudo: ...
0
votes
0answers
15 views

password changed by poppassd doesn't reflect smbpasswd

I have installed poppassd and coded a php script for users to change their passwords via web. However I noticed that what being changed via poppassd did not reflect users' samba password. Any pointers ...
1
vote
1answer
242 views

inactive option not working for pam_lastlog.so

I'm trying to set up my system to lock out inactive users after 10 days. I'm using CentOS 6.x, and looking at RHEL manual, this is what I found: To lock out an account after 10 days of inactivity, ...
2
votes
0answers
291 views

Ldap client on CoreOS

Has anyone setup ldap on CoreOS before? If so, how does one do such a task? I have a cluster of CoreOS machines and I'm trying to hook up this service Foxpass https://www.foxpass.com/ to it for user ...
0
votes
0answers
45 views

Can't setup mount of EncFS on user login

I've tried to setup EncFS to be mounted on user login as described in this guide excluding the Password Utility section, however it works with little success. The EncFS works properly (encryption/...
1
vote
2answers
93 views

Postfix omits realm (@domain) when checking for smtpd pam+mysql authentication

I've trying to configure Postfix so users can send email through SMTP having a username and password. And I'm trying to store credential within a MySQL database. I've taken the path of saslauthd and ...
18
votes
1answer
4k views

Slow ssh login - Activation of org.freedesktop.login1 timed out

On one of my servers I've noticed really delay on SSH logins. Connecting using the ssh -vvv options the delay occurs at debug1: Entering interactive session. extract of connection: debug1: ...
0
votes
1answer
197 views

pam google authenticator can't compute location of secret file

I've installed Google Authentication on all the machines in our system, and while the authentication during login works fine, our machines are producing logs that have this line over and over: sshd(...
0
votes
0answers
126 views

how to get my kvm-nodes monitored by the opennebula-server

I just set up an OpenNebula server with the oned running. I also set up a kvm-node to deploy virtual machines on. When I tried to add the kvm-node to the OpenNebula server with onehost create kvm-...
2
votes
1answer
761 views

cannot login via ssh

Can not login to SLES server via ssh as user1. At the same time I can login as root user without any problem. Authentication method is password based. In /etc/ssh/sshd_config I have ...
0
votes
0answers
178 views

centos7 pam_authz_search for *.group.company.com

Upgrading from Centos6 where we were using ldap.conf entry "pam_check_host_attr=yes" previously, with wildcard 'host' attribute in ldap where the host attribute looked like 'host=*.group.company.com' ...
1
vote
0answers
182 views

SSO Linux and AD Trusted Domain

Having successfully built a one-way trust between 2 AD domains, we can't lookup/id the user in the trusted domain. Here's our use case. AD1: dom1.com (Win2k8 R2) - One-way outgoing trust to AD2 AD2:...
1
vote
2answers
931 views

pam_limits: Operation not permitted for sshd

Debian 8.0, pam 1.1.8-3.1, sshd 1:6.7p1-5. I'm trying to permanently increase the maximum number of open files. In /etc/pam.d/ I've got: /etc/pam.d# grep pam_limits.so * atd:session required ...
1
vote
1answer
53 views

How does pam_limits decide on the default limits?

In a linux system that is using the pam_limits module, but has nothing configured in /etc/security/limits.conf (or /etc/security/limits.d/*) how does pam_limits decided on what limits to implement?
3
votes
1answer
119 views

ssh as user runs program with no authentication (neither password nor keys)

I'd like to set up a user on my system (Ubuntu 14.04 x64) such that people can run ssh example@myhost.example.com and see some output from a program without being prompted for a password or having to ...
1
vote
0answers
65 views

Ubuntu 14.04 “azureuser” exists - and I did not create it

I just logged into an Ubuntu 14.04 instance and in the home folder there is a user "azureuser" (yes, this is an Azure VM) with four items in it: .ssh (folder) .bash_logout (file) .bashrc (file) ....
2
votes
0answers
323 views

LDAP Not working for SSH connections on ubuntu 12.04

Connecting from the client to the server: $ ssh -vvv user@10.0.50.170 OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 debug1: Reading configuration data /etc/ssh_config debug1: /etc/ssh_config line 20: ...
3
votes
1answer
400 views

LDAP authentication fails

I try to set up an LDAP directory that will allow me to authenticate Debian users. Once the configuration of the LDAP server and PAM files is done, the authentication fails. I think the client doesn't ...
1
vote
0answers
22 views

The differences between libpam-ldap and libpam-ldapd, included packages and modules? [duplicate]

May I ask what's the differences between libpam-ldap and libpam-ldapd when it comes to included packages and modules? As i understand is nss-pam-ldapd the project of libpam-ldapd, which is an ...
1
vote
0answers
56 views

Remote home-folders with optional but preferred locally-encrypted folder

I have the use case that on default all users are working within remote mounted home directories. However, sometimes they prefer a local home on one or more machines, e.g. because the network is too ...
2
votes
2answers
882 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
2
votes
1answer
145 views

SSHD applying different PAM rules for localhost connections

I am attempting to implement Yubikey auth via SSH. I've edited my /etc/pam.d/sshd file as follows, and it seems to work while connecting locally (ssh user@localhost): #%PAM-1.0 auth required ...
1
vote
0answers
79 views

How to properly automount tmpfs inside encrypted home folder on login?

I have a user with encrypted home folder which is automounted on login with pam_ecryptfs module. I would also like to have several folders automounted as tmpfs using local configuration file from ...
-1
votes
1answer
290 views

Curious what server pam_pwdfile is in var/log/messages

I am getting tons of these messages in my /var/log/messages file Apr 16 06:58:20 server pam_pwdfile[7856]: couldn't open password file /etc/techproxy.shadow Apr 16 06:58:20 server pam_pwdfile[7863]: ...
0
votes
2answers
80 views

Disable ssh login on specified time for particular users

I would like to disable ssh login to my system for particular users say X,and Y on specified time 17.00 to 18.00. so how to achieve this ? any help would be appreciated.
2
votes
1answer
566 views

Is it possible to ignore a missing PAM module?

I am configuring yubico-pam to enable passwordless sudo access using challenge-response from a Yubikey. The following works: # /etc/pam.d/sudo auth sufficient pam_yubico.so mode=challenge-...
1
vote
1answer
194 views

How can I change the directory in wich pam_mkhomedir creates the user's home directories?

I am using pam_mkhomedir to automatically create user's home directories when they first log in. However, the home directories are created inside the /home directory, while i need them to be created ...
14
votes
2answers
2k views

How to prevent users from extending their window of valid login

Been working on some security hardening procedures for a RedHat box, and I wanted to know if would be possible to prevent a user from changing his password, once it's expired. For one of our clients ...
1
vote
1answer
607 views

Check if account is allowed when using pam_access

I'm using pam_access and /etc/security/access.conf to restrict who can login to my Rhel 6.5 hosts. I have an LDAP server with a diverse user base, and the security people would like a list of who can ...
0
votes
1answer
771 views

migrate samba users to new server

I've read How to migrate Samba User Accounts to a new linux server? however it doesn't address my situation, or at least not with a solution. I have a RHEL 5 machine, wood, running Samba, Dovecot, ...
4
votes
1answer
46 views

Use more complex AND/OR structure with PAM

PAM allows to use sufficent and required for some logic, like auth sufficient pam_a.so auth required pam_b.so auth required pam_c.so which would mean "either a is true, or b must be true and then c ...