Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

1
vote
1answer
70 views

On Solaris, can I create a user account in a single command line entry that is not disabled, but is password disabled (only allows SSH)

I am building a script for SA's to follow when performing a certain task. That task requires adding a user to a system that can only SSH to the system (using a key) and not log in with a password. ...
0
votes
0answers
176 views

authenticating and authorizing linux users kept in mysql database using pam and nss

I am not able to authenticate and authorize users present in my mysql database. If someone can point out where I am wrong it would be very helpful.Following are the steps that I followed. Firstly I ...
0
votes
0answers
26 views

Linux PAM auth chain w/ module independence

I have a working PAM configuration using google_authentitcator in addition to the standard pam_unix password module as a two factor solution. In short it prompts (requisite) for a verification code ...
0
votes
1answer
965 views

CentOS PAM unable to open /etc/pam.d/system-auth

In gdm I have checked "Require smartcard login" but forgot about adding any smartcard for authentication. Then I've tried to boot from LiveCD and disable SC auth. Something went wrong and now I am not ...
3
votes
1answer
843 views

Public-Key -or- Password & Google Authenticator for SSH Login

I found an article (http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/) that explains how to configure OpenSSH to ask for a Google Authenticator ...
6
votes
1answer
168 views

Different “RequiredAuthentications2” for sshd and sftp subsystem

we're currently using a 2factor authentication on our SSH servers, so we have "RequiredAuthentications2 publickey,keyboard-interactive" in our sshd_config (publickey for the key, keyboard-interactive ...
1
vote
1answer
619 views

Account Lockout with pam_faillock in RHEL6

Previously, I asked about using pam_tally2 under RHEL6. I would like to pose this question and answer to document the recommended use of pam_faillock over pam_tally2 for the same function; What is ...
3
votes
2answers
890 views

OpenSSH and PAM authentication using a public key

I'm looking for a way to authenticate users using a public key which is stored in a db (MongoDB). Similar questions usually resulted with a suggestion to installed a patched version of OpenSSH ...
4
votes
3answers
245 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source. Managing access to multiple linux system One problem I ran into is that if a user is given local root ...
2
votes
1answer
220 views

build user chroot on first login

I'm using ldap for remote user authentication and I basically need to either figure out how to: a. chroot a user on machine b from machine a via nfs,(which doesn't seem possible without mounting ...
1
vote
0answers
168 views

How to add two-factor authetntication to ssh?

I am trying to add 2FA to sshd using PAM from oathtool package. I want two ways to login to server: publickey and 2FA, or password and 2FA So far I managed to add 2FA to publickey authentication, ...
10
votes
6answers
7k views

pam service(sshd) ignoring max retries

I have vps that I use to run a webserver on, it currently runs ubuntu server 12.04. Since a few weeks I keep getting a lot of errors in my ssh console. 2014 Apr 11 08:41:18 vps847 PAM service(sshd) ...
0
votes
1answer
2k views

How to I authenticate with Dovecot + IMAP + PAM on CentOS?

I set up Dovecot IMAP to use PAM as suggested here: http://wiki2.dovecot.org/PasswordDatabase/PAM PAM/dovecot [root@ip-172-31-15-65 pam.d]# cat dovecot #%PAM-1.0 auth required ...
0
votes
0answers
179 views

Apache + PAM + Winbind slow logins

Since upgrading our old Debian Lenny server to Ubuntu 12.04, we've noticed intermittent slow or failed access to Apache. Many or most web requests work fine, but occasionally, a Subversion client ...
1
vote
0answers
86 views

Centos 6.2 Openwebmail change password issue

Recently build environment to test, install openldap, openwebmail and PAM authentication module After experiencing the current account login webmail change password will be "password is wrong, change ...
0
votes
0answers
204 views

Run pam_exec after home directory creation CentOS 6

How can I make a pam_exec script in /etc/pam.d/sshd run after the home directory has been created? I am on CentOS 6.5 and use network accounts via PBIS / Likewise-Open. Right now, if a new user ...
-1
votes
1answer
291 views

User authentication; PAM or Radius? [closed]

At college I'm part of a group of students that keep a server infrastructure running for the students. Lately we've been having a lot of trouble with the servers, and we decided that it's probably ...
0
votes
0answers
235 views

pam_unix and pam_userdb authentication failure log for VSFTPD

I see this in my /var/log/auth.log file for all the connection to my FTP server : Mar 26 12:30:13 production vsftpd: pam_unix(vsftpd:auth): check pass; user unknown Mar 26 12:30:13 production vsftpd: ...
0
votes
0answers
94 views

OpenLDAP+pam_ldap+ppolicy does not notify user that they are blocked

We have an OpenLDAP server configured to use the password policy overlay in order to lock users when they reach a certain number of failed password attempts. This is working perfectly but when a ...
0
votes
0answers
26 views

libnss-pgsql logging transaction on screen

I've been configuring a pg database to authenticate user against pam. I installed libpam_pgsql and libnss_pgsql2. After I finish configuring the libnss_pgsql2, creating and editing the nss-pgsql.conf ...
1
vote
1answer
274 views

Use a PHP script to authenticate users on Linux

I have a web application running built in PHP using MySQL as database. I'm trying to give specific users access to a Linux system via SSH to perform simple command-line tasks. Since I do already have ...
1
vote
1answer
38 views

is this normal behavior for pam_tty_audit

I've recently configured pam_tty_audit, and while it does log information, it seems like it does not log information until after the user has logged out. Oddly enough, it does log some things live, ...
0
votes
0answers
440 views

pam_tally2 being called before Password entry

Based on the suggestion given in: Account Lockout with pam_tally2 in RHEL6 I have come to a working configuration, wherein account is getting locked out after 3 failed logins. Catch is that ...
1
vote
2answers
802 views

Linux nested groups with winbind

We have several RHEL6 servers connected to Active Directory using winbind. All servers are configured identically using a configuration management tool. Servers however produce different results when ...
5
votes
1answer
247 views

Combination of SSH key auth, and two-factor authentication

I was wondering if it is possible to accomplish the following, all at the same time: Disable root logins Enable SSH login for personal user, only via SSH keys Enable SSH login for unprivileged user, ...
2
votes
0answers
334 views

How to mount share in pam_mount.conf.xml depending of OU

I have a Microsoft Windows domain and I want to add the ubuntu machines with Likewise-Open. There is no problem with that, but in my windows machines I have a GPO that mount a net share depending of ...
1
vote
1answer
235 views

PAM won't authenticate with mysql (make_scrambled_password deprecated)

I have spent some time searching for this and it seems I'm the only one having problem with PAM not authenticating through mysql due to current updates so I thought I will post my problem here and if ...
4
votes
1answer
440 views

Prevent fork bomb inside docker container

I am currently struggling with limiting number of processes for user which I called sandbox. I configured processes limit inside /etc/security/limits.conf like this: sandbox hard nproc ...
1
vote
2answers
3k views

Configuring vsftpd to authenticate with Active Directory

We are trying to give vsftpd access to some Active Directory users. Here are some configuration file contents: # egrep -v '^(#.*|)$' vsftpd.conf anonymous_enable=YES local_enable=YES ...
0
votes
0answers
124 views

Writing vsftpd logs to a database

I found this useful post relating this topic: http://www.supertom.com/code/vsftpd_mysql_syslog_configuration.html Unfortunately it is not a tutorial but kind of a notepad for the author. After some ...
3
votes
1answer
206 views

Virtual users in sshd from a postgres database

I have a Postgresql database full of user accounts, and i would like to allow these user to access a server through ssh, using only public keys authentification. So far, i have setup these parts on ...
0
votes
0answers
167 views

Mounting EncFS with PAM at SSH login with password protected key

I'm running OpenSUSE 12.3 on a VM in the cloud and have an EncFS directory set up. I can mount it manually fine. I'm trying to have the directory mounted at SSH login, ideally only for the duration ...
0
votes
0answers
419 views

Netatalk authentication randomly fails over WiFi

Background info: I have an Ubuntu 12.04 server on which I have Samba (v3.6.3) and Netatalk (v3.1.0) installed. I use TimeMachine on my Mac to backup to the Ubuntu server over AFP provided by ...
1
vote
0answers
235 views

postgresql: invalid authentication method “pam”: not supported by this build

When I try to start postgresql 9.3.1 I receive this in startup log: # cat /var/lib/pgsql/pgstartup.log LOG: could not create IPv6 socket: Address family not supported by protocol LOG: invalid ...
1
vote
1answer
489 views

pam_cracklib reports bad password correctly but pam_unix module STILL changes the password

I am currently trying to use pam_cracklib which properly fails according to my debug.log but even though it is setup as a password requisite entry in my PAM config file, it still falls through to the ...
1
vote
3answers
3k views

ulimit -n not changing - values limits.conf has no effect

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. This question is somewhat of a follow up to this question. open file descriptor limits.conf setting ...
0
votes
1answer
516 views

Authenticate Radius user using pam and ssh [duplicate]

I am able to authenticate radius users using radius server+pam+ssh with creating local user with blank password in linux. Is it possible to authenticate radius users without creating users in local ...
0
votes
0answers
294 views

Pam password policy not working for root

I was following this guide (http://xmodulo.com/2013/12/set-password-policy-linux.html) for setting up pam and password for policy for CentOS. Everything works great except the root or any user's ...
0
votes
1answer
231 views

PAM exec stdout issue

I am having an issue with a dead simple python script; called with pam_exec. I added a line at the end of that file /etc/pam.d/common-session : session optional pam_exec.so /bin/python ...
1
vote
0answers
173 views

OpenLDAP on ArchLinux users cannot change passwd

I started an office and i NEED centralized login and home directories to work. Since all workstations are going to run Arch and problems with different LDAP versions I finally concluded the LDAP ...
0
votes
1answer
595 views

Can't login with KDM and SSSD but works fine from console

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically: Jan 9 ...
0
votes
1answer
229 views

OpenLDAP client configuration. Can search but cannot login?

I'm trying to set up LDAP on a Gentoo workstation to authenticate against a central server. However, I encountered some issues and I really hope you guys can help me out here :) First off, the LDAP ...
2
votes
0answers
264 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
1
vote
1answer
39 views

SSH listen on 2 ports, With a single config

Im trying to make SSH logins require 2 factor auth but only on one port. So port 1 is open only to a list of ip's managed by iptables. and only requires password / key port 2 is open to all, But ...
2
votes
3answers
849 views

How can I delay sshd login after bad password

How can I delay the retry response from SSH when a bad password is tried or unsuccessful login attempt. I wanted the delay to be 2-3 second more that usual. I could not find any option in ...
0
votes
0answers
47 views

How can I set path for non-interactive user authenticated using LDAP?

On a Mac running OSX 10.7.5, I need to set the PATH for non-interactive users who connect via ssh and are authenticated using LDAP. It's the same question that was asked (and answered) here: Updating ...
4
votes
1answer
683 views

How to use PAM to check LDAP password for some users, yet always use UID/GIDs from local files?

For a subset of my users in /etc/passwd, I would like to configure PAM (on Linux) to do the password checking part of the logon against an LDAP server, ignoring that these users are actually are ...
1
vote
2answers
9k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
1
vote
2answers
258 views

How does Cron interact with Kerberos for authentication?

I have a CentOS 6.4 machine which is set up with pam_ldap and pam_krb5. It is configured to use our Active Directory servers for authentication. I can SSH into the machine using AD accounts. I have ...
2
votes
3answers
433 views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...