Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

3
votes
2answers
2k views

Using ecryptfs encrypted home directories with Dovecot

I have setup home directory encryption on Ubuntu 10.04 machine, but ecryptfs does not seem to be able to work with Dovecot (or CourierIMAP, etc). After successful IMAP login, home directory is never ...
3
votes
3answers
1k views

How to set up two-factor authentication with OTP on FreeBSD?

I have a FreeBSD server that I like to be able to get to from anywhere. Normally I use SSH publickey to log in, or if I don't have my SSH private key available then I might use regular password over ...
3
votes
2answers
7k views

PAM / LDAP authentication with Ubuntu 10.04

I can't wrap my brain around the new pam.d configuration syntax used in Ubuntu 10.04. How do I setup PAM so that it allows users stored in my LDAP database to login. I already configured nscd, so id ...
3
votes
2answers
2k views

PPTPD with PAM authentication?

I need a VPN solution for my company. One requirement is to be able to use the built-in windows VPN client. We are running a Debian Etch server. I've managed to set up PPTPD but the authentication is ...
3
votes
1answer
274 views

Virtual users in sshd from a postgres database

I have a Postgresql database full of user accounts, and i would like to allow these user to access a server through ssh, using only public keys authentification. So far, i have setup these parts on ...
3
votes
0answers
2k views

Linux samba server: cifs_mount failed w/return code = -12

Server: RHEL 5.9 / smbd 3.0.33 - Clients: various, though all were using current mount.cifs (5.2) I already solved this problem, but it was such a nightmare to hunt down these error codes I felt like ...
2
votes
5answers
2k views

su to myself without password

How can one set it up so that su to the same user that is currently logged in, that is foo$ su -c 'something' foo does not require a password? This wouldn't add or remove any security, as it ...
2
votes
2answers
2k views

How to automatically create user accounts ( SSH + LDAP )

I set up remote LDAP server (Server1) and SSH with pam_ldap on Server2. Everything is working ok, I can login to SSH with LDAP credentials. But when I want to add new user, I have to firstly create it ...
2
votes
3answers
3k views

How to use PAM to limit failed login attempts by IP?

I'm working through a process of hardening my server security against the daily hacking attempts that arise the moment you attach a server to an IP and give it a domain name. I get anywhere from 1 to ...
2
votes
4answers
12k views

Centos 6 Linux and nss-pam-ldapd

I am trying get centos 6 to authenticate against ldap (active directory to be specific) I am a bit confuse though because after installing nss-pam-ldapd I see several files that appear to be the same ...
2
votes
3answers
886 views

Programmatic way to validate a Linux Login/password

I would to like to validate a username and password correspond to a valid unix account. The current solution I have uses expect to wait for a password prompt and then supply the password and see if ...
2
votes
2answers
2k views

FreeBSD LDAP authentication, pam_ldap, can't bind

I've been able to get some of my linux servers authenticating users against my LDAP directory server, but I've been having some trouble trying to do this with nss_ldap and pam_ldap in FreeBSD. Going ...
2
votes
3answers
3k views

cron+pam heavily spamming my logs

Two times every minute I get this in auth.log: May 12 15:21:01 ruptai CRON[25303]: pam_unix(cron:session): session opened for user root by (uid=0) May 12 15:21:01 ruptai CRON[25303]: ...
2
votes
2answers
5k views

pam_ldap and ldaps can't contact ldap server

I'm trying to allow authentication via LDAP on a CentOS host system. But I always get a Can't contact LDAP server error from pam_ldap. The LDAP server is pingable and authentication works perfectly ...
2
votes
3answers
7k views

ulimit -n not changing - values limits.conf has no effect

I am trying to raise the open file descriptor maximum for all users on an ubuntu machine. This question is somewhat of a follow up to this question. open file descriptor limits.conf setting ...
2
votes
3answers
620 views

How to handle centralized user authentication without LDAP?

I'm attempting to create a centralized database for my users for my server and web accesses, so that I can allow those users to log in through ssh if they have access, and through my web services to ...
2
votes
1answer
7k views

PAM unable to dlopen(/lib64/security/pam_fprintd.so) causing CentOS/Redhat server to crash

CentOS 6, Parallels PLESK 10.4, Apache One of my servers went down over the weekend much to my dismay. On the day and time it occurred, my log errors/messages end with this - /var/log/secure: Jul ...
2
votes
4answers
4k views

How to access Unix passwd file from Apache when using .htaccess?

Is it possible to use the system passwd file for accessing a protected web page with Apache on Linux? Setting up multiple password files for shell access, Apache and Samba is a pain. If there is a ...
2
votes
2answers
2k views

Authenticate CVS users against Active Directory

I have a mixed Linux/Windows software development environment where the Linux clients are migrating to a system where they are able to authenticate against Active Directory. (That part I figured out) ...
2
votes
3answers
8k views

PBIS Open AD authentication stops working on ubuntu with errors: “user accout has expired” and “is your account locked?”

We have been using PowerBroker Identity Services Open to authenticate active directory users from ubuntu hosts successfully for six months. Recently AD authentication stopped working on several ...
2
votes
4answers
4k views

PAM module causes flurry of SSH sessions

While tailing /var/log/auth.log I noticed that there where multiple entries being entered (instantly) by the minute for user "foo". I personally had only one connection open as user "root_bar" while ...
2
votes
1answer
599 views

map remote ssh user to a different local user

All my boxes have the same username for myself, except one legacy machine where I'm loath to try to change it. Whenever I ssh to the machine, I forget to specify my user name, and my password is ...
2
votes
1answer
211 views

Why is sshd engaging PAM still?

Background/Behavior is: if you ssh to box via and GSSAPI/Kerberos succeeds and you have a local user in /etc/passwd, you login fine per below PAM config. All Good there. But if you don't have a ...
2
votes
2answers
196 views

Debugging a Postfix Saslauthd PAM-PGsql authentication failure

I've set up pam-pgsql to lookup passwords in my database for Postfix via Saslauthd. I can test credentials using the command line: $ sudo testsaslauthd -u user@email.com -p password 0: NO ...
2
votes
1answer
734 views

edit crontab for apache

I am transfering crontabs from an old server (centos 5.5) to a a new (centos 6.0) and there is a problem with (the most important) user apache. On the new server I am getting the following: ...
2
votes
1answer
205 views

Customize PAM messages

I would like to customize my password expiration warnings. I figured PAM reads them from somewhere, but can't find from where. The question is relevant for both Ubuntu/Debian and Fedora/RHEL/CentOS. ...
2
votes
1answer
2k views

sshd: How to enable PAM authentication for specific users under

I am using sshd, and allow logins with public key authentication. I want to allow select users to log in with a PAM two-factor authentication module. Is there any way I can allow PAM two-factor ...
2
votes
1answer
556 views

Passwd via PAM only work for LDAP

Now I'v got a working setup using PAM+LDAP over SSL but I can only passwd users in the ldap tree, any idea about how to be able to passwd every users ? Here are some conf files : ...
2
votes
3answers
6k views

How to use Linux username and password with Subversion?

I'd like to setup Subversion repository so that same username and password could be used to access repository as in ssh login. I managed to get login work so that correct username is required, but it ...
2
votes
2answers
881 views

Join Red Hat Linux 6 to a Windows Active Directory Domain

I am using Red Hat 6 (for testing purpose) and configure samba with active directory.Red Hat 6 has successfully join with my windows server 2003 domain. By typing the command [root@mainserver /] # ...
2
votes
3answers
98 views

is there a PAM module for DNSBL lookups?

I have been enumerating the remaining security concerns on one of my back-end production servers, when I came to the realization that something which could be incredibly useful was missing from my ...
2
votes
1answer
201 views

Disable hostname resolution in PAM

When authenticating using PAM, PAM exposes the remote host to the module. On the code side of things, it exposes this via PAM_RHOST using pam_get_item(). However, PAM will attempt to resolve the IP ...
2
votes
1answer
93 views

configuring pam with flat files backend

I would like to configure pam module to use flat files for authentication. Basically I need same thing like pam_unix just with possibility to use different files (other than /etc/passwd and ...
2
votes
1answer
2k views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
2
votes
2answers
947 views

pam_unix(su:session): session opened for user

Jun 26 15:58:52 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0) Jun 26 15:59:02 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0) Jun 26 ...
2
votes
3answers
5k views

How can I install pam_mount on Centos 6 x86_64?

I need to use pam_mount to mount user home directories individually at the time that each user logs in. I cant locate a package for this, at least for Centos 6. I would not have a problem building ...
2
votes
1answer
934 views

Trying to solve “nginx too many files”

We recently started getting the following error on one of our nginx boxes: 2011/05/25 16:35:51 [alert] 3580#0: accept() failed (24: Too many open files) Checking /etc/security/limits.conf, we have ...
2
votes
1answer
304 views

PAM example of performing authentication using a custom external script?

I've heard that you can use pam_exec to call an external script, and have that external script perform the actual authentication. Can anyone provide an example of doing this?
2
votes
1answer
296 views

Is there a way to map user names for LDAP in PAM?

I'm managed to set up LDAP in PAM (linux). A problem I have is that many users have different user names in LDAP than on the local machine... Is there a way to map those user names (e.g. local ...
2
votes
1answer
616 views

How to make dovecot not ask passwords from localhost?

I have set up dovecot server and I'm currently using offline imap to sync my gmail to the dovecot imap running on the localhost. Currently I'm using plain text authentication, but this results in ...
2
votes
2answers
890 views

Can I disable Pam Loginuid? Can I find out options used to configure kernel?

I am getting a lot of the following types of error in my secure log on a CentOS 5.4 server: crond[10445]: pam_loginuid(crond:session): set_loginuid failed opening loginuid sshd[10473]: ...
2
votes
1answer
279 views

Dealing with LDAP failure when using it for PAM/NSS?

I use a redundant pair of OpenLDAP servers for PAM auth and directory services via NSS. It's been 100% reliable so far, but nothing runs flawlessly forever. What steps should I take now so I have a ...
2
votes
1answer
579 views

How do I skip the OTP passphrase prompt for sudo but keep it for ssh?

I've configured a server to support OTP (using opie) with ssh. What annoys me is that I get the OTP passphrase prompt even for root when doing sudo. How can I configure PAM to suppress it? Don't ...
2
votes
1answer
981 views

Radius + SSH Key Authentication

Does anyone know if it is possible to configure pam to require both radius AND ssh-key to successfully authenticate ?
2
votes
1answer
2k views

Console user locked out - pam problems?

I am trying to enable AD authentication for Debian stable servers to enable users to logon via ssh authenticating against Windows AD. It all works fine and I can ssh to the server using my Windows ...
2
votes
1answer
37 views

cannot login via ssh

Can not login to SLES server via ssh as user1. At the same time I can login as root user without any problem. Authentication method is password based. In /etc/ssh/sshd_config I have ...
2
votes
2answers
128 views

OpenSSH two factor authentication combined with Kerberos / public key

I'm trying to implement two-factor authentication for OpenSSH. The environment is Centos 7 (kernel: 3.10.0-229.1.2.el7.x86_64) with OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013. We have Active ...
2
votes
1answer
77 views

fail2ban did not ban anything, regardless of the settings

this is the first time that i did not find a solution here. so, hopefully it can be solved. i've installed a fresh, new ubuntu minimal system (14.04) with ssh on it. Right after that i installed ...
2
votes
4answers
575 views

PAM, RADIUS, Google Authenticator and Two Factor Auth

I have setup FreeRADIUS, PAM and the Google Authtenicator. FreeRADIUS calls PAM, which in turn calls the Google pam_google_authenticator.so libary. That all works successfully. However, that's not ...
2
votes
1answer
443 views

How can I limit failed sasl2/pam_mysql login retries?

I have Postfix setup serving multiple virtual domains on a CentOS box - and all works as expected. Client's login are authenticated through sasl2 (saslauthd) and pam_mysql. And when a login attempt ...