Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

2
votes
4answers
3k views

PAM module causes flurry of SSH sessions

While tailing /var/log/auth.log I noticed that there where multiple entries being entered (instantly) by the minute for user "foo". I personally had only one connection open as user "root_bar" while ...
2
votes
4answers
10k views

Centos 6 Linux and nss-pam-ldapd

I am trying get centos 6 to authenticate against ldap (active directory to be specific) I am a bit confuse though because after installing nss-pam-ldapd I see several files that appear to be the same ...
2
votes
3answers
3k views

sssd vs nslcd for RHEL-5/6

We have 50 RH-5 machines and 70 RH-6 machines. I am looking to decide what we should use for LDAP: nscd/nslcd for all RH-5/RH-6 servers nscd/nslcd for RH-5 servers, sssd for RH-6 servers sssd for ...
2
votes
1answer
534 views

edit crontab for apache

I am transfering crontabs from an old server (centos 5.5) to a a new (centos 6.0) and there is a problem with (the most important) user apache. On the new server I am getting the following: ...
2
votes
1answer
168 views

Customize PAM messages

I would like to customize my password expiration warnings. I figured PAM reads them from somewhere, but can't find from where. The question is relevant for both Ubuntu/Debian and Fedora/RHEL/CentOS. ...
2
votes
1answer
1k views

sshd: How to enable PAM authentication for specific users under

I am using sshd, and allow logins with public key authentication. I want to allow select users to log in with a PAM two-factor authentication module. Is there any way I can allow PAM two-factor ...
2
votes
1answer
544 views

Passwd via PAM only work for LDAP

Now I'v got a working setup using PAM+LDAP over SSL but I can only passwd users in the ldap tree, any idea about how to be able to passwd every users ? Here are some conf files : ...
2
votes
3answers
6k views

How to use Linux username and password with Subversion?

I'd like to setup Subversion repository so that same username and password could be used to access repository as in ssh login. I managed to get login work so that correct username is required, but it ...
2
votes
3answers
68 views

is there a PAM module for DNSBL lookups?

I have been enumerating the remaining security concerns on one of my back-end production servers, when I came to the realization that something which could be incredibly useful was missing from my ...
2
votes
1answer
245 views

build user chroot on first login

I'm using ldap for remote user authentication and I basically need to either figure out how to: a. chroot a user on machine b from machine a via nfs,(which doesn't seem possible without mounting ...
2
votes
1answer
77 views

configuring pam with flat files backend

I would like to configure pam module to use flat files for authentication. Basically I need same thing like pam_unix just with possibility to use different files (other than /etc/passwd and ...
2
votes
2answers
650 views

pam_unix(su:session): session opened for user

Jun 26 15:58:52 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0) Jun 26 15:59:02 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0) Jun 26 ...
2
votes
1answer
1k views

Force SHA when user changes LDAP password using passwd

I'm trying to setup PAM/LDAP so that when a logged in SSH user changes their password using passwd, it encrypts the password with SHA1 before updating the LDAP entry. I have this # /etc/ldap.conf ... ...
2
votes
1answer
857 views

Trying to solve “nginx too many files”

We recently started getting the following error on one of our nginx boxes: 2011/05/25 16:35:51 [alert] 3580#0: accept() failed (24: Too many open files) Checking /etc/security/limits.conf, we have ...
2
votes
1answer
287 views

PAM example of performing authentication using a custom external script?

I've heard that you can use pam_exec to call an external script, and have that external script perform the actual authentication. Can anyone provide an example of doing this?
2
votes
1answer
287 views

Is there a way to map user names for LDAP in PAM?

I'm managed to set up LDAP in PAM (linux). A problem I have is that many users have different user names in LDAP than on the local machine... Is there a way to map those user names (e.g. local ...
2
votes
1answer
560 views

How to make dovecot not ask passwords from localhost?

I have set up dovecot server and I'm currently using offline imap to sync my gmail to the dovecot imap running on the localhost. Currently I'm using plain text authentication, but this results in ...
2
votes
2answers
819 views

Can I disable Pam Loginuid? Can I find out options used to configure kernel?

I am getting a lot of the following types of error in my secure log on a CentOS 5.4 server: crond[10445]: pam_loginuid(crond:session): set_loginuid failed opening loginuid sshd[10473]: ...
2
votes
1answer
268 views

Dealing with LDAP failure when using it for PAM/NSS?

I use a redundant pair of OpenLDAP servers for PAM auth and directory services via NSS. It's been 100% reliable so far, but nothing runs flawlessly forever. What steps should I take now so I have a ...
2
votes
1answer
549 views

How do I skip the OTP passphrase prompt for sudo but keep it for ssh?

I've configured a server to support OTP (using opie) with ssh. What annoys me is that I get the OTP passphrase prompt even for root when doing sudo. How can I configure PAM to suppress it? Don't ...
2
votes
1answer
894 views

Radius + SSH Key Authentication

Does anyone know if it is possible to configure pam to require both radius AND ssh-key to successfully authenticate ?
2
votes
1answer
2k views

Console user locked out - pam problems?

I am trying to enable AD authentication for Debian stable servers to enable users to logon via ssh authenticating against Windows AD. It all works fine and I can ssh to the server using my Windows ...
2
votes
1answer
1k views

LDAP authentication on CentOS 7

After upgrading to CentOS 7 it's no longer possible to login via LDAP. With CentOS 6 I used the package pam_ldap which worked fine, but now pam_ldap is no longer available for the new version of ...
2
votes
1answer
376 views

How can I limit failed sasl2/pam_mysql login retries?

I have Postfix setup serving multiple virtual domains on a CentOS box - and all works as expected. Client's login are authenticated through sasl2 (saslauthd) and pam_mysql. And when a login attempt ...
2
votes
1answer
1k views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
2
votes
3answers
4k views

pam_ldap.so before pam_unix.so? Is it ever possible?

we have a couple of servers with PAM+LDAP. The configuration is standard (see http://arthurdejong.org/nss-pam-ldapd/setup or http://wiki.debian.org/LDAP/PAM). For example, /etc/pam.d/common-auth ...
2
votes
1answer
477 views

pam_cracklib on Linux: how to disable credits

The pam_cracklib 'minlen' does not work as I want it to. PAM allows passwords even with lesser length than it is set to with the 'minlen' option. It gives credits (by default 1) to the 'upper-case', ...
2
votes
1answer
2k views

vsftp login errors 530 login incorrect

Using Ubuntu 10.04 on an aws ec2 instance. I was happy just using ssh but then a wordpress plugin needs ftp access...I just need ftp access for one site www.sitebuilt.net which is in /home/sitebuil. ...
2
votes
1answer
834 views

Problem with mixed cases in username

We have integrated a linux thin client with an AD using kerberos, pam and winbindd. We are using pam_mkhomedir to make the home dir, and that works fine. But the login scripts don't run when the AD ...
2
votes
3answers
4k views

How can I install pam_mount on Centos 6 x86_64?

I need to use pam_mount to mount user home directories individually at the time that each user logs in. I cant locate a package for this, at least for Centos 6. I would not have a problem building ...
2
votes
1answer
750 views

pam_exec.so PAM module does not export variable PAM_USER as stated in the documentation

I'm trying to use the pam_exec.so PAM module to execute a script which needs to know the username/password coming from the application (OpenVPN in this case). I have a script that executes printenv ...
2
votes
1answer
479 views

Linux password complexity settings

I have two questions about the system-auth file 1) If the /etc/pam.d/system-auth password complexity settings are changed on an existing system, does it invalidate any existing passwords? 2) Is it ...
2
votes
1answer
589 views

How to change UNIX user password using passwd if user is stored in a MySQL database?

I'm trying to setup libnss-mysql and libpam-mysql. So far everything has been working. I can use id to get information about the users stored in my databas. getent passwd is working, as well. However, ...
2
votes
3answers
4k views

ldap force user to change password

I am using CentOS-ds (based off Redhat-DS and 389 directory servers). I have LDAP setup, and working to authenticate users (and Sudo, thats a handy feature!). even passwd is working great to change ...
2
votes
2answers
2k views

I cannot su when LDAP is running

I have problem with ldap, that when it is online, I login with user/pass from LDAP db and then cannot su to root with local pass. When I turn offline LDAP I can login with local user/pass and su to ...
2
votes
3answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
2
votes
2answers
1k views

samba authentication via pam_pwdfile

When starting with the default samba configuration, what settings need to be changed to make samba authenticate it's users through pam? I'm attempting to authenticate samba users via pam, and ...
2
votes
2answers
721 views

How do I make a pam configuration to test that the account exists and ignore password?

I want to create a pam.d configuration file that will test that a user has an account but will not test the password. How should I go about this? I've tried using nullok but I've not been able to ...
2
votes
1answer
99 views

Kerberos-PAM authentication failure: pam or pre-authentication

kinit -p 'username' works -- no problem with the setup of the Kerberos realm. I can't get the login from the GUI to work, however. Client auth.log: pam_krb5(gdm3:auth): user <username> ...
2
votes
0answers
269 views

RHEL 6.5 web application PAM AUTH pam_oddjob_mkhomedir

I've got a RHEL 6.5 that authenicates against an AD server, that side is working fine. The machine is also running a web application that uses a PAM module to authenticate. I copied login to make a ...
2
votes
1answer
78 views

pam_tally2 causing unwanted lockouts with SCOM or Nervecenter

We use pam_tally2 in our system-auth config file which works fine for users. With services such as SCOM or Nervecenter it causes lockouts. Same behavior on RHEL5 and RHEL6 This is ...
2
votes
0answers
357 views

How to mount share in pam_mount.conf.xml depending of OU

I have a Microsoft Windows domain and I want to add the ubuntu machines with Likewise-Open. There is no problem with that, but in my windows machines I have a GPO that mount a net share depending of ...
2
votes
0answers
272 views

Authentization agains Samba4 domain controler and not working kinit

I've a problem with Samba 4 and Kerberos. If I call kinit, it writes Client not found in Kerberos database while getting initial credentials. I find out, that the Kerberos works with user name only, ...
2
votes
1answer
315 views

PAM Winbind Expired Password

We've got Winbind/Kerberos setup on RHEL for AD authentication. Working fine however I noticed that when a password has expired, we get a warning but shell access is still granted. What's the ...
2
votes
0answers
2k views

Linux samba server: cifs_mount failed w/return code = -12

Server: RHEL 5.9 / smbd 3.0.33 - Clients: various, though all were using current mount.cifs (5.2) I already solved this problem, but it was such a nightmare to hunt down these error codes I felt like ...
2
votes
0answers
162 views

pam_mysql / vsftpd error 'AUTHENTICATION FALURE (FIRST_PASS)'

I setup vsftpd and mysql auth via pam on Debian Squeeze. Config: auth required pam_mysql.so user=server passwd=x host=localhost db=server table=ftp usercolumn=username passwdcolumn=password ...
2
votes
1answer
335 views

Authenticate Git virtual users via PAM

Can Git authenticate virtual users via PAM? In particular, would Git require some additional utility, such as gitolite or gitosis?
2
votes
1answer
1k views

How do I disable password complexity in pam

I found tons of articles how to enable password complexity, can someone guide me to how to disable it? (oracle linux) This is my system-auth #%PAM-1.0 # This file is auto-generated. # User changes ...
2
votes
1answer
813 views

Linux ldap authentication, pam_filter ignored

I've set up linux client authentication via ldap, it works. I want to control user's access to several services by adding or removing different OUs for accounts. E.g., if user is allowed to login ...
2
votes
1answer
462 views

Adding local users / passwords on Kerberized Linux box

Right now if I try to add a non-system user not in the university's Kerberos realm I am prompted for a Kerberos password anyway. Obviously there is no password to be entered, so I just press enter and ...