Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
0answers
26 views

libnss-pgsql logging transaction on screen

I've been configuring a pg database to authenticate user against pam. I installed libpam_pgsql and libnss_pgsql2. After I finish configuring the libnss_pgsql2, creating and editing the nss-pgsql.conf ...
1
vote
2answers
3k views

Configuring vsftpd to authenticate with Active Directory

We are trying to give vsftpd access to some Active Directory users. Here are some configuration file contents: # egrep -v '^(#.*|)$' vsftpd.conf anonymous_enable=YES local_enable=YES ...
1
vote
1answer
38 views

is this normal behavior for pam_tty_audit

I've recently configured pam_tty_audit, and while it does log information, it seems like it does not log information until after the user has logged out. Oddly enough, it does log some things live, ...
0
votes
0answers
440 views

pam_tally2 being called before Password entry

Based on the suggestion given in: Account Lockout with pam_tally2 in RHEL6 I have come to a working configuration, wherein account is getting locked out after 3 failed logins. Catch is that ...
5
votes
1answer
248 views

Combination of SSH key auth, and two-factor authentication

I was wondering if it is possible to accomplish the following, all at the same time: Disable root logins Enable SSH login for personal user, only via SSH keys Enable SSH login for unprivileged user, ...
2
votes
0answers
334 views

How to mount share in pam_mount.conf.xml depending of OU

I have a Microsoft Windows domain and I want to add the ubuntu machines with Likewise-Open. There is no problem with that, but in my windows machines I have a GPO that mount a net share depending of ...
5
votes
3answers
9k views

The difference between /etc/pam.d/login and /etc/pam.d/system-auth?

I want to configure securetty to limit root directly access. Now I am clear if I add: auth required pam_securetty.so into /etc/pam.d/system-auth, and keep only "console" in ...
3
votes
1answer
206 views

Virtual users in sshd from a postgres database

I have a Postgresql database full of user accounts, and i would like to allow these user to access a server through ssh, using only public keys authentification. So far, i have setup these parts on ...
0
votes
0answers
124 views

Writing vsftpd logs to a database

I found this useful post relating this topic: http://www.supertom.com/code/vsftpd_mysql_syslog_configuration.html Unfortunately it is not a tutorial but kind of a notepad for the author. After some ...
1
vote
1answer
735 views

pam_exec.so PAM module does not export variable PAM_USER as stated in the documentation

I'm trying to use the pam_exec.so PAM module to execute a script which needs to know the username/password coming from the application (OpenVPN in this case). I have a script that executes printenv ...
0
votes
1answer
756 views

Kerberos pre-authentication failed on nfs mount

I have the following nfs export: /home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) When trying to mount that on a client I get: client:/home # ...
0
votes
0answers
167 views

Mounting EncFS with PAM at SSH login with password protected key

I'm running OpenSUSE 12.3 on a VM in the cloud and have an EncFS directory set up. I can mount it manually fine. I'm trying to have the directory mounted at SSH login, ideally only for the duration ...
2
votes
3answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
1
vote
0answers
235 views

postgresql: invalid authentication method “pam”: not supported by this build

When I try to start postgresql 9.3.1 I receive this in startup log: # cat /var/lib/pgsql/pgstartup.log LOG: could not create IPv6 socket: Address family not supported by protocol LOG: invalid ...
0
votes
0answers
420 views

Netatalk authentication randomly fails over WiFi

Background info: I have an Ubuntu 12.04 server on which I have Samba (v3.6.3) and Netatalk (v3.1.0) installed. I use TimeMachine on my Mac to backup to the Ubuntu server over AFP provided by ...
4
votes
1answer
3k views

How to use nginx PAM module?

I would like to use nginx PAM module to authenticate a site with existing users on a FreeBSD system. I tried to use pam_unix.so, but no luck. It's just not let me in with my usr/psw pair. :( nginx ...
1
vote
1answer
489 views

pam_cracklib reports bad password correctly but pam_unix module STILL changes the password

I am currently trying to use pam_cracklib which properly fails according to my debug.log but even though it is setup as a password requisite entry in my PAM config file, it still falls through to the ...
2
votes
1answer
1k views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
4
votes
2answers
992 views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
0
votes
1answer
516 views

Authenticate Radius user using pam and ssh [duplicate]

I am able to authenticate radius users using radius server+pam+ssh with creating local user with blank password in linux. Is it possible to authenticate radius users without creating users in local ...
0
votes
0answers
294 views

Pam password policy not working for root

I was following this guide (http://xmodulo.com/2013/12/set-password-policy-linux.html) for setting up pam and password for policy for CentOS. Everything works great except the root or any user's ...
0
votes
1answer
231 views

PAM exec stdout issue

I am having an issue with a dead simple python script; called with pam_exec. I added a line at the end of that file /etc/pam.d/common-session : session optional pam_exec.so /bin/python ...
1
vote
0answers
173 views

OpenLDAP on ArchLinux users cannot change passwd

I started an office and i NEED centralized login and home directories to work. Since all workstations are going to run Arch and problems with different LDAP versions I finally concluded the LDAP ...
0
votes
1answer
596 views

Can't login with KDM and SSSD but works fine from console

I have LDAP authentication set up with SSSD and I can login fine through console and ssh. However when I try to login through KDM it just says authentication failure... More specifically: Jan 9 ...
0
votes
1answer
231 views

OpenLDAP client configuration. Can search but cannot login?

I'm trying to set up LDAP on a Gentoo workstation to authenticate against a central server. However, I encountered some issues and I really hope you guys can help me out here :) First off, the LDAP ...
2
votes
2answers
4k views

debian: cannot change password

As the root user, I can change the password: hussie:/home/claudiu# passwd Enter new password: Retype new password: passwd: password updated successfully As a non-root user I cannot: ...
0
votes
1answer
2k views

pam_auth_radius - RADIUS users vs unix users

I have recently set up a server with FreeRADIUS to authenticate and keep track of admin logins on some of my devices. I'm looking at getting my Linux and FreeBSD machines authenticating against ...
2
votes
0answers
265 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
2
votes
1answer
886 views

Radius + SSH Key Authentication

Does anyone know if it is possible to configure pam to require both radius AND ssh-key to successfully authenticate ?
1
vote
1answer
39 views

SSH listen on 2 ports, With a single config

Im trying to make SSH logins require 2 factor auth but only on one port. So port 1 is open only to a list of ip's managed by iptables. and only requires password / key port 2 is open to all, But ...
2
votes
3answers
851 views

How can I delay sshd login after bad password

How can I delay the retry response from SSH when a bad password is tried or unsuccessful login attempt. I wanted the delay to be 2-3 second more that usual. I could not find any option in ...
0
votes
0answers
47 views

How can I set path for non-interactive user authenticated using LDAP?

On a Mac running OSX 10.7.5, I need to set the PATH for non-interactive users who connect via ssh and are authenticated using LDAP. It's the same question that was asked (and answered) here: Updating ...
1
vote
2answers
9k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: ...
4
votes
1answer
683 views

How to use PAM to check LDAP password for some users, yet always use UID/GIDs from local files?

For a subset of my users in /etc/passwd, I would like to configure PAM (on Linux) to do the password checking part of the logon against an LDAP server, ignoring that these users are actually are ...
1
vote
2answers
258 views

How does Cron interact with Kerberos for authentication?

I have a CentOS 6.4 machine which is set up with pam_ldap and pam_krb5. It is configured to use our Active Directory servers for authentication. I can SSH into the machine using AD accounts. I have ...
0
votes
1answer
196 views

AD Login to Solaris Zone Periodically Not Working

I have a Solaris 11.1 zone named "AZone". I have the zone joined to an Active Directory domain (Windows Server 2008) with the goal of users being able to use their AD account to log in to the Solaris ...
2
votes
3answers
433 views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
1
vote
1answer
189 views

PAM Module works fine on i386 but fails on x64 when used in vsftpd

We have a custom PAM module that works fine on our i386 development machines but when we try and use it in production on our x64 production servers with vsftpd it fails. The PAM module has been ...
2
votes
1answer
306 views

PAM Winbind Expired Password

We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted. What's the ...
1
vote
1answer
87 views

PAM problems with “success=N” action

I want to run a script when an authentication failure occurs. But, with the following conf file, authenitcation always fails even when the proper credentials are supplied. auth [success=1 ...
2
votes
1answer
456 views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...
1
vote
1answer
848 views

How to restore pam confiugration?

I did some modifications in "/etc/pam.d/common-auth , /etc/pam.d/common-account , /etc/pam.d/common-password , /etc/pam.d/common-session" files. Is there any way to restore default pam configuration?. ...
2
votes
3answers
3k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
2
votes
3answers
4k views

pam_ldap.so before pam_unix.so? Is it ever possible?

we have a couple of servers with PAM+LDAP. The configuration is standard (see http://arthurdejong.org/nss-pam-ldapd/setup or http://wiki.debian.org/LDAP/PAM). For example, /etc/pam.d/common-auth ...
1
vote
1answer
97 views

SSH/ Telnet PAM configuration

How do I configure maximum number of login attempts before the session is dropped for SSH/telnet in PAM?
2
votes
1answer
7k views

ssh: “Access denied by PAM account configuration” for one non-root user but not another

On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is ...
1
vote
1answer
79 views

Limiting login via access.conf not working

I'm running Debian Wheezy and having a rough time getting /etc/security/access.conf changes to apply. Tangentially, I believe there could be an issue with PAM in general as I have been unable to get ...
0
votes
1answer
161 views

system authentication and radius authentication

I am using CentOS 6.3 and want to enable ssh RADIUS authentication along with Centos system Authentication. Right now my server is firstly authenticated with RADIUS server. And after system ...
0
votes
1answer
377 views

PAM: auth: pam_unix(dovecot:auth): authentication failure;

We have opnldap setup on our ubuntu server, and were getting this message for a user: auth: pam_unix(dovecot:account): account has expired (account expired) Sep 3 19:05:03 auth: ...
3
votes
1answer
535 views

How to make exception in password locking via pam_tally2 for specific user?

I need to make an exception for a specific user, so that his failed logins are not counted by pam_tally2, and well, this is not a root account (I'd use magic_root then). Is it doable?