Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

2
votes
3answers
2k views

How to use PAM to limit failed login attempts by IP?

I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
2
votes
3answers
795 views

Programmatic way to validate a Linux Login/password

I would to like to validate a username and password correspond to a valid unix account. The current solution I have uses expect to wait for a password prompt and then supply the password and see if ...
2
votes
2answers
2k views

FreeBSD LDAP authentication, pam_ldap, can't bind

I've been able to get some of my linux servers authenticating users against my LDAP directory server, but I've been having some trouble trying to do this with nss_ldap and pam_ldap in FreeBSD. Going ...
2
votes
3answers
2k views

cron+pam heavily spamming my logs

Two times every minute I get this in auth.log: May 12 15:21:01 ruptai CRON[25303]: pam_unix(cron:session): session opened for user root by (uid=0) May 12 15:21:01 ruptai CRON[25303]: ...
2
votes
2answers
219 views

How are services mapped to the files in /etc/pam.d?

How does pam decide which files in /etc/pam.d to use depending on whether a user logs in via ssh, locally, a serial console, etc?
2
votes
2answers
3k views

pam_ldap and ldaps can't contact ldap server

I'm trying to allow authentication via LDAP on a CentOS host system. But I always get a Can't contact LDAP server error from pam_ldap. The LDAP server is pingable and authentication works perfectly ...
2
votes
3answers
557 views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
2
votes
1answer
6k views

PAM unable to dlopen(/lib64/security/pam_fprintd.so) causing CentOS/Redhat server to crash

CentOS 6, Parallels PLESK 10.4, Apache One of my servers went down over the weekend much to my dismay. On the day and time it occurred, my log errors/messages end with this - /var/log/secure: Jul ...
2
votes
4answers
4k views

How to access Unix passwd file from Apache when using .htaccess?

Is it possible to use the system passwd file for accessing a protected web page with Apache on Linux? Setting up multiple password files for shell access, Apache and Samba is a pain. If there is a ...
2
votes
4answers
11k views

Centos 6 Linux and nss-pam-ldapd

I am trying get centos 6 to authenticate against ldap (active directory to be specific) I am a bit confuse though because after installing nss-pam-ldapd I see several files that appear to be the same ...
2
votes
2answers
2k views

Authenticate CVS users against Active Directory

I have a mixed Linux/Windows software development environment where the Linux clients are migrating to a system where they are able to authenticate against Active Directory. (That part I figured out) ...
2
votes
4answers
4k views

PAM module causes flurry of SSH sessions

While tailing /var/log/auth.log I noticed that there where multiple entries being entered (instantly) by the minute for user "foo". I personally had only one connection open as user "root_bar" while ...
2
votes
1answer
570 views

map remote ssh user to a different local user

All my boxes have the same username for myself, except one legacy machine where I'm loath to try to change it. Whenever I ssh to the machine, I forget to specify my user name, and my password is ...
2
votes
1answer
122 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
2
votes
2answers
99 views

Debugging a Postfix Saslauthd PAM-PGsql authentication failure

I've set up pam-pgsql to lookup passwords in my database for Postfix via Saslauthd. I can test credentials using the command line: $ sudo testsaslauthd -u user@email.com -p password 0: NO ...
2
votes
1answer
642 views

edit crontab for apache

I am transfering crontabs from an old server (centos 5.5) to a a new (centos 6.0) and there is a problem with (the most important) user apache. On the new server I am getting the following: ...
2
votes
1answer
187 views

Customize PAM messages

I would like to customize my password expiration warnings. I figured PAM reads them from somewhere, but can't find from where. The question is relevant for both Ubuntu/Debian and Fedora/RHEL/CentOS. ...
2
votes
1answer
2k views

sshd: How to enable PAM authentication for specific users under

I am using sshd, and allow logins with public key authentication. I want to allow select users to log in with a PAM two-factor authentication module. Is there any way I can allow PAM two-factor ...
2
votes
1answer
548 views

Passwd via PAM only work for LDAP

Now I'v got a working setup using PAM+LDAP over SSL but I can only passwd users in the ldap tree, any idea about how to be able to passwd every users ? Here are some conf files : ...
2
votes
3answers
6k views

How to use Linux username and password with Subversion?

I'd like to setup Subversion repository so that same username and password could be used to access repository as in ssh login. I managed to get login work so that correct username is required, but it ...
2
votes
1answer
302 views

Fedora 21 pam_sss authentication failure - permission denied

We have configured a OpenLDAP server which is working fine. FreeBSD, Debian, and a WordPress plugin authenticate with no problems. We are configuring Fedora 21 with pam_sss, but we get the following ...
2
votes
3answers
89 views

is there a PAM module for DNSBL lookups?

I have been enumerating the remaining security concerns on one of my back-end production servers, when I came to the realization that something which could be incredibly useful was missing from my ...
2
votes
1answer
178 views

Disable hostname resolution in PAM

When authenticating using PAM, PAM exposes the remote host to the module. On the code side of things, it exposes this via PAM_RHOST using pam_get_item(). However, PAM will attempt to resolve the IP ...
2
votes
1answer
84 views

configuring pam with flat files backend

I would like to configure pam module to use flat files for authentication. Basically I need same thing like pam_unix just with possibility to use different files (other than /etc/passwd and ...
2
votes
2answers
840 views

pam_unix(su:session): session opened for user

Jun 26 15:58:52 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0) Jun 26 15:59:02 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0) Jun 26 ...
2
votes
1answer
914 views

Trying to solve “nginx too many files”

We recently started getting the following error on one of our nginx boxes: 2011/05/25 16:35:51 [alert] 3580#0: accept() failed (24: Too many open files) Checking /etc/security/limits.conf, we have ...
2
votes
1answer
290 views

PAM example of performing authentication using a custom external script?

I've heard that you can use pam_exec to call an external script, and have that external script perform the actual authentication. Can anyone provide an example of doing this?
2
votes
1answer
292 views

Is there a way to map user names for LDAP in PAM?

I'm managed to set up LDAP in PAM (linux). A problem I have is that many users have different user names in LDAP than on the local machine... Is there a way to map those user names (e.g. local ...
2
votes
1answer
597 views

How to make dovecot not ask passwords from localhost?

I have set up dovecot server and I'm currently using offline imap to sync my gmail to the dovecot imap running on the localhost. Currently I'm using plain text authentication, but this results in ...
2
votes
2answers
3k views

Suggest methods for testing changes to “pam.d/common-*” files

How do I test the changes to the pam.d configuration files: Do I need to restart the PAM service to test the changes? Should I go through every service listed in the /etc/pam.d/ directory? I'm ...
2
votes
2answers
864 views

Can I disable Pam Loginuid? Can I find out options used to configure kernel?

I am getting a lot of the following types of error in my secure log on a CentOS 5.4 server: crond[10445]: pam_loginuid(crond:session): set_loginuid failed opening loginuid sshd[10473]: ...
2
votes
1answer
274 views

Dealing with LDAP failure when using it for PAM/NSS?

I use a redundant pair of OpenLDAP servers for PAM auth and directory services via NSS. It's been 100% reliable so far, but nothing runs flawlessly forever. What steps should I take now so I have a ...
2
votes
1answer
571 views

How do I skip the OTP passphrase prompt for sudo but keep it for ssh?

I've configured a server to support OTP (using opie) with ssh. What annoys me is that I get the OTP passphrase prompt even for root when doing sudo. How can I configure PAM to suppress it? Don't ...
2
votes
1answer
951 views

Radius + SSH Key Authentication

Does anyone know if it is possible to configure pam to require both radius AND ssh-key to successfully authenticate ?
2
votes
1answer
2k views

Console user locked out - pam problems?

I am trying to enable AD authentication for Debian stable servers to enable users to logon via ssh authenticating against Windows AD. It all works fine and I can ssh to the server using my Windows ...
2
votes
1answer
62 views

fail2ban did not ban anything, regardless of the settings

this is the first time that i did not find a solution here. so, hopefully it can be solved. i've installed a fresh, new ubuntu minimal system (14.04) with ssh on it. Right after that i installed ...
2
votes
4answers
322 views

PAM, RADIUS, Google Authenticator and Two Factor Auth

I have setup FreeRADIUS, PAM and the Google Authtenicator. FreeRADIUS calls PAM, which in turn calls the Google pam_google_authenticator.so libary. That all works successfully. However, that's not ...
2
votes
1answer
5k views

LDAP authentication on CentOS 7

After upgrading to CentOS 7 it's no longer possible to login via LDAP. With CentOS 6 I used the package pam_ldap which worked fine, but now pam_ldap is no longer available for the new version of ...
2
votes
1answer
411 views

How can I limit failed sasl2/pam_mysql login retries?

I have Postfix setup serving multiple virtual domains on a CentOS box - and all works as expected. Client's login are authenticated through sasl2 (saslauthd) and pam_mysql. And when a login attempt ...
2
votes
1answer
1k views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
2
votes
1answer
513 views

pam_cracklib on Linux: how to disable credits

The pam_cracklib 'minlen' does not work as I want it to. PAM allows passwords even with lesser length than it is set to with the 'minlen' option. It gives credits (by default 1) to the 'upper-case', ...
2
votes
1answer
2k views

vsftp login errors 530 login incorrect

Using Ubuntu 10.04 on an aws ec2 instance. I was happy just using ssh but then a wordpress plugin needs ftp access...I just need ftp access for one site www.sitebuilt.net which is in /home/sitebuil. ...
2
votes
1answer
1k views

Problem with mixed cases in username

We have integrated a linux thin client with an AD using kerberos, pam and winbindd. We are using pam_mkhomedir to make the home dir, and that works fine. But the login scripts don't run when the AD ...
2
votes
3answers
4k views

How can I install pam_mount on Centos 6 x86_64?

I need to use pam_mount to mount user home directories individually at the time that each user logs in. I cant locate a package for this, at least for Centos 6. I would not have a problem building ...
2
votes
1answer
811 views

pam_exec.so PAM module does not export variable PAM_USER as stated in the documentation

I'm trying to use the pam_exec.so PAM module to execute a script which needs to know the username/password coming from the application (OpenVPN in this case). I have a script that executes printenv ...
2
votes
1answer
514 views

Linux password complexity settings

I have two questions about the system-auth file 1) If the /etc/pam.d/system-auth password complexity settings are changed on an existing system, does it invalidate any existing passwords? 2) Is it ...
2
votes
1answer
611 views

How to change UNIX user password using passwd if user is stored in a MySQL database?

I'm trying to setup libnss-mysql and libpam-mysql. So far everything has been working. I can use id to get information about the users stored in my databas. getent passwd is working, as well. However, ...
2
votes
3answers
5k views

ldap force user to change password

I am using CentOS-ds (based off Redhat-DS and 389 directory servers). I have LDAP setup, and working to authenticate users (and Sudo, thats a handy feature!). even passwd is working great to change ...
2
votes
2answers
2k views

I cannot su when LDAP is running

I have problem with ldap, that when it is online, I login with user/pass from LDAP db and then cannot su to root with local pass. When I turn offline LDAP I can login with local user/pass and su to ...
2
votes
2answers
1k views

samba authentication via pam_pwdfile

When starting with the default samba configuration, what settings need to be changed to make samba authenticate it's users through pam? I'm attempting to authenticate samba users via pam, and ...