Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
1answer
3k views

Authentication failure of OpenVPN client against Active Directory

I'm getting the following error (client side) when connecting to my OpenVPN server: AUTH: Received AUTH_FAILED control message and on the server I get thefollowing error message in teh openvpn logs:...
0
votes
0answers
105 views

CentOS7 ldap client not authenticating with ldap server

I am using ApacheDS which was a breeze to setup thanks to the apacheds mailing list. I am able to retrieve ldapsearch results, however, I am not able to get anything by doing a:"getent passwd ". [...
0
votes
0answers
82 views

PAM - Ignore local user, if LDAP-connection works

I have configured some SLED10SP1 (not allowed to update) machines to use LDAP for user authentication. Because SLED10 doesn't have official packages for pam_ccreds or sssd, I have to find a way to ...
1
vote
1answer
370 views

SSH Authentication using RADIUS + Google Authenticator

I'm trying configure my SSHD's to authenticate users using FreeRadius. The FreeRadius server needs to first require a valid OTP using Google Authenticator, and then verify the system account password. ...
5
votes
5answers
211 views

Filter LDAP user through PAM so it appears to not exist at all

In our corporate environment long ago some wiz decided to put the user "mysql" into LDAP. The account is disabled: $ sudo su - mysql This account is currently not available. ...but it's id still ...
1
vote
0answers
95 views

PAM Google Authenticator With SFTP And Other Apps

I'm attempting to set up a situation where SSH Authorized Key + Google Authenticator Code is sufficient to ssh into the server. This is working fine for normal SSH terminal operations - I'm prompted ...
1
vote
0answers
180 views

SSO Linux and AD Trusted Domain

Having successfully built a one-way trust between 2 AD domains, we can't lookup/id the user in the trusted domain. Here's our use case. AD1: dom1.com (Win2k8 R2) - One-way outgoing trust to AD2 AD2:...
0
votes
1answer
53 views

PAM standard macros and logging on CentOS7

According to the D(x) macro defined in pam_macros.h (source code) and used as follows: D(("Hello PAM World")); Where is this log located on CentOS7? Note that I am using as flag debug in my pam.d ...
0
votes
2answers
126 views

/var/log/secure reporting false positives

I have my CentOS 6 system configured to use sssd with ldap provider. I am able to login and use sudo, however /var/log/secure always reports authentication failure: Sep 18 07:09:52 serverA sudo: ...
0
votes
1answer
352 views

Pam-Mysql “Can't initialize threads: error 11”

Inside a Debian OpenVZ container, I have 2 OpenVPN servers (udp on port 53 and tcp on port 443). The authentication is based on Pam-Mysql. Inside my OpenVPN conf file I have: [...] plugin /etc/...
0
votes
0answers
15 views

password changed by poppassd doesn't reflect smbpasswd

I have installed poppassd and coded a php script for users to change their passwords via web. However I noticed that what being changed via poppassd did not reflect users' samba password. Any pointers ...
1
vote
3answers
3k views

Why isn't my cronjob running?

I have a cronjob in /etc/cron.d/mycron that looks like this: 0 3 * * * apache php /path/to/my/script.php In the same file there are other cronjobs begin run as root and other users (which ...
1
vote
1answer
238 views

inactive option not working for pam_lastlog.so

I'm trying to set up my system to lock out inactive users after 10 days. I'm using CentOS 6.x, and looking at RHEL manual, this is what I found: To lock out an account after 10 days of inactivity, ...
2
votes
0answers
289 views

Ldap client on CoreOS

Has anyone setup ldap on CoreOS before? If so, how does one do such a task? I have a cluster of CoreOS machines and I'm trying to hook up this service Foxpass https://www.foxpass.com/ to it for user ...
6
votes
4answers
2k views

Is there a command line two-factor authentication verification code generator?

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup ...
5
votes
4answers
36k views

kinit & pam_sss: Cannot find KDC for requested realm while getting initial credentials

I have a very similar problem as described in this thread on CentOS 6.3 authenticating against a 2008R2 AD DC. Here is my krb5.conf, I know for a fact that XXXXXXX.LOCAL is the true domain name: [...
1
vote
3answers
2k views

PAM Authentication with LDAP on Debian Jessie Not Finding LDAP Users

Debian Jessie (specifically, Debian Server Wheezy x64 with testing repos) OpenLDAP 2.4.39 libpam-ldapd 0.9.4-1 Upon installing libpam-ldapd, the dpkg configuration asked for my LDAP address ...
1
vote
2answers
93 views

Postfix omits realm (@domain) when checking for smtpd pam+mysql authentication

I've trying to configure Postfix so users can send email through SMTP having a username and password. And I'm trying to store credential within a MySQL database. I've taken the path of saslauthd and ...
0
votes
1answer
472 views

tacacs+ for Linux authentication/authorization using pam_tacplus

I am using TACACS+ to authenticate Linux users using pam_tacplus.so PAM module and it works without issues. I have modified the pam_tacplus module to meet some of my custom requirements. I know by ...
3
votes
3answers
1k views

LDAP and pam without binddn and anonymous access

I am working in a large company and can use its central read-only LDAP server remotely. The LDAP server does not allow anonymous binding. In order to use this server for authentication of the users on ...
0
votes
1answer
195 views

pam google authenticator can't compute location of secret file

I've installed Google Authentication on all the machines in our system, and while the authentication during login works fine, our machines are producing logs that have this line over and over: sshd(...
0
votes
0answers
126 views

how to get my kvm-nodes monitored by the opennebula-server

I just set up an OpenNebula server with the oned running. I also set up a kvm-node to deploy virtual machines on. When I tried to add the kvm-node to the OpenNebula server with onehost create kvm-...
1
vote
1answer
181 views

auditd auid changes after su

I try to implement individual accountability for my RHEL systems using selinux and the audit.log. I followed the instructions given here: Log all commands run by admins on production servers If I ...
2
votes
1answer
722 views

cannot login via ssh

Can not login to SLES server via ssh as user1. At the same time I can login as root user without any problem. Authentication method is password based. In /etc/ssh/sshd_config I have ...
2
votes
2answers
996 views

pam_exec.so PAM module does not export variable PAM_USER as stated in the documentation

I'm trying to use the pam_exec.so PAM module to execute a script which needs to know the username/password coming from the application (OpenVPN in this case). I have a script that executes printenv &...
1
vote
2answers
915 views

pam_limits: Operation not permitted for sshd

Debian 8.0, pam 1.1.8-3.1, sshd 1:6.7p1-5. I'm trying to permanently increase the maximum number of open files. In /etc/pam.d/ I've got: /etc/pam.d# grep pam_limits.so * atd:session required ...
0
votes
0answers
174 views

centos7 pam_authz_search for *.group.company.com

Upgrading from Centos6 where we were using ldap.conf entry "pam_check_host_attr=yes" previously, with wildcard 'host' attribute in ldap where the host attribute looked like 'host=*.group.company.com' ...
12
votes
2answers
957 views

What do the OS X authorization mechanisms actually do?

Background  I'm trying to glean a better understanding of the OS X login process, in order to decide the best way for achieving VPN Single Sign On. Please do correct me if I'm wrong, but I believe ...
0
votes
3answers
564 views

validate only one user with pam ldap and nslcd

I want only user "theuser" to login to this host. I have tried the following in nslcd.conf: pam_authz_search (&(objectClass=posixAccount)(IsActive=TRUE)(uid=theuser)) but all can login. If ...
1
vote
1answer
53 views

How does pam_limits decide on the default limits?

In a linux system that is using the pam_limits module, but has nothing configured in /etc/security/limits.conf (or /etc/security/limits.d/*) how does pam_limits decided on what limits to implement?
0
votes
1answer
774 views

pam-auth-update without the text UI

Is there a way to run pam-auth-update (or some equivalent command), non-interactively on Ubuntu 12.04. I'm trying to automate this process for a number of machines, and the curses interface is making ...
2
votes
2answers
861 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
3
votes
0answers
1k views

Ubuntu server + Samba + PAM + Apple OpenDirectory

Due to various reasons, we are looking to migrate our file servers from OS X Server 10.9 over to a true Samba implementation running on Ubuntu 14.04LTS. We have Ubuntu up and running with Samba ...
3
votes
1answer
119 views

ssh as user runs program with no authentication (neither password nor keys)

I'd like to set up a user on my system (Ubuntu 14.04 x64) such that people can run ssh example@myhost.example.com and see some output from a program without being prompted for a password or having to ...
3
votes
1answer
397 views

LDAP authentication fails

I try to set up an LDAP directory that will allow me to authenticate Debian users. Once the configuration of the LDAP server and PAM files is done, the authentication fails. I think the client doesn't ...
2
votes
0answers
321 views

LDAP Not working for SSH connections on ubuntu 12.04

Connecting from the client to the server: $ ssh -vvv user@10.0.50.170 OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011 debug1: Reading configuration data /etc/ssh_config debug1: /etc/ssh_config line 20: ...
1
vote
0answers
65 views

Ubuntu 14.04 “azureuser” exists - and I did not create it

I just logged into an Ubuntu 14.04 instance and in the home folder there is a user "azureuser" (yes, this is an Azure VM) with four items in it: .ssh (folder) .bash_logout (file) .bashrc (file) ....
1
vote
0answers
22 views

The differences between libpam-ldap and libpam-ldapd, included packages and modules? [duplicate]

May I ask what's the differences between libpam-ldap and libpam-ldapd when it comes to included packages and modules? As i understand is nss-pam-ldapd the project of libpam-ldapd, which is an ...
9
votes
3answers
4k views

libpam-ldap or libpam-ldapd?

I'm setting up LDAP authentication on my personal VPS, and Ubuntu has two packages for the same purpose: libpam-ldap and libpam-ldapd. Which should I use?
4
votes
5answers
6k views

limits.conf not being applied.

I have the following lines in /etc/security/limits.conf * soft nofile 32768 * hard nofile 65536 root soft nofile 32768 root ...
1
vote
0answers
56 views

Remote home-folders with optional but preferred locally-encrypted folder

I have the use case that on default all users are working within remote mounted home directories. However, sometimes they prefer a local home on one or more machines, e.g. because the network is too ...
2
votes
1answer
143 views

SSHD applying different PAM rules for localhost connections

I am attempting to implement Yubikey auth via SSH. I've edited my /etc/pam.d/sshd file as follows, and it seems to work while connecting locally (ssh user@localhost): #%PAM-1.0 auth required ...
1
vote
1answer
2k views

getent and ldapsearch results are inconsistent concerning the loginShell

I have a test that creates a user in LDAP with /bin/bash and I then modify the ldap attributes to /bin/noshell but the results from getent and ldapsearch are inconsistent for the shell. This user does ...
1
vote
0answers
79 views

How to properly automount tmpfs inside encrypted home folder on login?

I have a user with encrypted home folder which is automounted on login with pam_ecryptfs module. I would also like to have several folders automounted as tmpfs using local configuration file from ...
-1
votes
1answer
288 views

Curious what server pam_pwdfile is in var/log/messages

I am getting tons of these messages in my /var/log/messages file Apr 16 06:58:20 server pam_pwdfile[7856]: couldn't open password file /etc/techproxy.shadow Apr 16 06:58:20 server pam_pwdfile[7863]: ...
0
votes
2answers
80 views

Disable ssh login on specified time for particular users

I would like to disable ssh login to my system for particular users say X,and Y on specified time 17.00 to 18.00. so how to achieve this ? any help would be appreciated.
6
votes
4answers
828 views

FreeIPA: prevent local root accessing user accounts

So after asking this question, I've been test-driving FreeIPA as a central authentication source based on this question: Managing access to multiple linux system One problem I ran into is that if a ...
2
votes
1answer
562 views

Is it possible to ignore a missing PAM module?

I am configuring yubico-pam to enable passwordless sudo access using challenge-response from a Yubikey. The following works: # /etc/pam.d/sudo auth sufficient pam_yubico.so mode=challenge-...
1
vote
2answers
6k views

smbpasswd: Failed to add entry for user

tl;dr Assuming a basic (but functioning) LDAP/PAM configuration, how come smbpasswd fails with this error message when I try to add an existing UNIX/LDAP user to Samba? I have a basic, but working ...
1
vote
1answer
192 views

How can I change the directory in wich pam_mkhomedir creates the user's home directories?

I am using pam_mkhomedir to automatically create user's home directories when they first log in. However, the home directories are created inside the /home directory, while i need them to be created ...