Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

1
vote
1answer
194 views

PAM Module works fine on i386 but fails on x64 when used in vsftpd

We have a custom PAM module that works fine on our i386 development machines but when we try and use it in production on our x64 production servers with vsftpd it fails. The PAM module has been ...
0
votes
1answer
213 views

AD Login to Solaris Zone Periodically Not Working

I have a Solaris 11.1 zone named "AZone". I have the zone joined to an Active Directory domain (Windows Server 2008) with the goal of users being able to use their AD account to log in to the Solaris ...
2
votes
1answer
318 views

PAM Winbind Expired Password

We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted. What's the ...
1
vote
1answer
94 views

PAM problems with “success=N” action

I want to run a script when an authentication failure occurs. But, with the following conf file, authenitcation always fails even when the proper credentials are supplied. auth [success=1 ...
1
vote
1answer
941 views

How to restore pam confiugration?

I did some modifications in "/etc/pam.d/common-auth , /etc/pam.d/common-account , /etc/pam.d/common-password , /etc/pam.d/common-session" files. Is there any way to restore default pam configuration?. ...
1
vote
1answer
99 views

SSH/ Telnet PAM configuration

How do I configure maximum number of login attempts before the session is dropped for SSH/telnet in PAM?
0
votes
1answer
172 views

Users Password does not reset after successful login at the console but works fine with SSH

The title says it all. I have my unsuccessful login attempts set to three. I purposefully fail logging in 2x, then when I SSH into the box successfully the 3rd time my count drops back to zero; ...
2
votes
1answer
8k views

ssh: “Access denied by PAM account configuration” for one non-root user but not another

On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is ...
4
votes
2answers
1k views

Understand PAM and NSS

In the last days I have set up some Linux system with LDAP authentication and everything works fine, but there's still something I can't really understand regarding NSS and PAM, also after a lot of ...
1
vote
1answer
83 views

Limiting login via access.conf not working

I'm running Debian Wheezy and having a rough time getting /etc/security/access.conf changes to apply. Tangentially, I believe there could be an issue with PAM in general as I have been unable to get ...
0
votes
1answer
173 views

system authentication and radius authentication

I am using CentOS 6.3 and want to enable ssh RADIUS authentication along with Centos system Authentication. Right now my server is firstly authenticated with RADIUS server. And after system ...
0
votes
1answer
391 views

PAM: auth: pam_unix(dovecot:auth): authentication failure;

We have opnldap setup on our ubuntu server, and were getting this message for a user: auth: pam_unix(dovecot:account): account has expired (account expired) Sep 3 19:05:03 auth: ...
3
votes
1answer
565 views

How to make exception in password locking via pam_tally2 for specific user?

I need to make an exception for a specific user, so that his failed logins are not counted by pam_tally2, and well, this is not a root account (I'd use magic_root then). Is it doable?
1
vote
1answer
119 views

Disable hostname resolution in PAM

When authenticating using PAM, PAM exposes the remote host to the module. On the code side of things, it exposes this via PAM_RHOST using pam_get_item(). However, PAM will attempt to resolve the IP ...
0
votes
1answer
363 views

Strange Change in ssh behavior + LDAP

We have a cluster with a front node that admits normal users and LDAP users. Two days ago the ssh show a strange behavior: The LDAP users can't login in the front node using password but, The LDAP ...
2
votes
3answers
3k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
3
votes
1answer
3k views

What is nsswitch compat mode?

Red Hat recommended me compat mode in /etc/nsswitch.conf as one of the options to enumerate LDAP users, but later said that it's not a much-used method. nsswitch.conf passwd: files compat ...
0
votes
1answer
160 views

What are disadvantages of using nsswitch compat?

In my current LDAP set-up "getent passwd" shows all 600+ users that exist in the LDAP, not enumerating only the 20 LDAP-users that have permission to access this netgroup/server. This can be solved ...
6
votes
1answer
377 views

Need help understanding PAM directives

I have the following directives in my /etc/pam.d/sshd file on a RHEL5 box and I'm a bit confused. These directives are there to make LDAP+RADIUS+OTP work. What I'm trying to do is tell pam not to ...
2
votes
1answer
376 views

How can I limit failed sasl2/pam_mysql login retries?

I have Postfix setup serving multiple virtual domains on a CentOS box - and all works as expected. Client's login are authenticated through sasl2 (saslauthd) and pam_mysql. And when a login attempt ...
1
vote
2answers
215 views

How can I allow users to change their local passwords?

We use an LDAP-server, but we also use local accounts. [jdoe@tst-03 ~]$ passwd Changing password for user jdoe. Changing password for jdoe. (current) UNIX password: Enter login(LDAP) password: This ...
0
votes
1answer
191 views

LDAP queries for local users

Recently, in the company where I work, we have had a general system crash and we are figuring out the causes. Our machines are configured for LDAP authentication plus some local users in some of them. ...
0
votes
0answers
293 views

pam-auth-update without the text UI

Is there a way to run pam-auth-update (or some equivalent command), non-interactively on Ubuntu 12.04. I'm trying to automate this process for a number of machines, and the curses interface is making ...
1
vote
1answer
148 views

vsftpd + vitual users + selinux

I can't make vsftpd to work and it is driving me crazy. The virtual users can connect, but they can't upload files or create folders. I hope someone can help me. I get this error in the ftp client: ...
0
votes
2answers
402 views

PAM LDAP configuration for non-local user authentication

I have a requirement to allow non-local user accounts to be logged in via LDAP authentication. Meaning, the user that is trying to login is allowed access, if the user account exists in LDAP server ...
3
votes
3answers
282 views

Is there a command line two-factor authentication verification code generator?

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup ...
1
vote
0answers
110 views

Trying to script rsync using pam_exec

I'm trying to write a bash script that will execute rsync when called by pam_exec. I've tried a couple different ways, and I'm not sure what I'm doing wrong. When I try to run the script at login by ...
1
vote
1answer
524 views

530 Login incorrect - vsftpd w/SSL (Not using PAM?)

I cannot log in with any local users on my vsftpd running on CentOS6 32-bit. The server simply reports login incorrect. My log files look like this: [doctorblue@guardian ~]$ sudo tail ...
1
vote
1answer
552 views

pam_tty_audit apparently not working

I just compiled pam_tty_audit module, because my Linux distro doesn't include it with the usual PAM modules. I included to the /etc/common-session the configuration line, as suggested in this ...
5
votes
4answers
339 views

Locking a user's account locally when kerberos is enabled

I'm trying to set up Chef-managed accounts for a group of machines with the following characteristics: If there is no local account, login is blocked. If there is a local account with SSH keys, use ...
0
votes
1answer
834 views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
3
votes
1answer
104 views

What does this plugable authentication module (PAM) “code” mean?

I am reading a configuration file for Linux PAM and am wondering what it means: auth [success=2 default=ignore] pam_krb5.so minimum_uid=1000 I understand that "auth" means this rule is ...
0
votes
1answer
792 views

Kerberos pre-authentication failed on nfs mount

I have the following nfs export: /home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) When trying to mount that on a client I get: client:/home # ...
0
votes
1answer
311 views

Dell OMSA Authentication Fail on Ubuntu

I am trying to log into an install of Dell OMSA 5 on a Dell PowerEdge 2850 running Ubuntu 8.04 LTS x64. OMSA is 32bit and is trying to load the 64bit pam modules for authentication. Whatever ...
0
votes
1answer
828 views

Account lockout setting in Centos 6

I'm trying to implement an account lockout after 3 fail sign-on attempt. Root is exempted. Here's what I have in my /etc/pam.d/system-auth file so far auth required pam_tally2.so deny=3 ...
3
votes
1answer
981 views

vsftpd - PAM - MySQL and pam_mkhomedir to create directories

I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection. Here is ...
1
vote
0answers
60 views

Set pam_unix password without knowing current password, having authenticated with pam_winbind

Right, so I have winbind authentication set up for login. However, I think there may still be some situations in which it would be useful for the user to be able to set their unix password (in the ...
0
votes
1answer
153 views

Lag between PAM password acceptance and session open on CentOS5

I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
0
votes
1answer
312 views

restarting authconfig changes order of my /etc/nsswitch.conf

Here is my nsswitch.conf: passwd: files ldap sss shadow: files ldap sss group: files sss When I restart authconfig, it removes ldap from passwd, shadow, and group. Here's my ...
0
votes
2answers
39 views

changing /etc/pam.d location

is there a way to change location of /etc/pam.d directory, or is it hardcoded into PAM? can't it be changed with some environment variable for specific client programs? for example: ...
0
votes
1answer
977 views

getent and ldapsearch results are inconsistent concerning the loginShell

I have a test that creates a user in LDAP with /bin/bash and I then modify the ldap attributes to /bin/noshell but the results from getent and ldapsearch are inconsistent for the shell. This user does ...
1
vote
1answer
649 views

Restricting LDAP users from authenticating without a valid shell

What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
0
votes
2answers
165 views

Requiring two-factor ssh authentication only from certain clients

I am about to make two-factor authentication mandatory for ssh logins using libpam_google_authenticator. I'd like to be able to waive this requirement when users log in from certain IP addresses. ...
1
vote
1answer
2k views

Linux PAM pam_succeed_if.so

I've specified an AD security group in PAM to restrict which domain users can login. I've also restricted sessions for AD users to this group. This prevents a logged in user from doing an "su -" to ...
0
votes
2answers
1k views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
70 views

Can I setup a Samba master password?

I want to be able to connect to a Samba share as a specific user but I don't know his password, and I don't want to change it. I did this on Dovecot by setting up a master password, can I do something ...
0
votes
2answers
228 views

Can't get pam_time.so to work with http

The /etc/security/time.conf man page contains this example: All users except for root are denied access to console-login at all times: login ; tty* & !ttyp* ; !root ; !Al0000-2400 For this ...
0
votes
1answer
238 views

Call Pam module before public key authentication on SSH

I am currently writing a pam module which does some checks if the key stored in authorized_keys is still valid. However I cant find a possiblity to run the module before the public key authentication ...
2
votes
0answers
2k views

Linux samba server: cifs_mount failed w/return code = -12

Server: RHEL 5.9 / smbd 3.0.33 - Clients: various, though all were using current mount.cifs (5.2) I already solved this problem, but it was such a nightmare to hunt down these error codes I felt like ...
1
vote
1answer
138 views

When changing passwords, how to let one PAM module check for old passwords and another to save new ones?

Our server is currently using the blowfish cipher to store passwords and it uses pam_unix2. We'd like to gradually switch to SHA. The idea is that all newly changed passwords would be hashed with SHA. ...