Pluggable authentication modules, a flexible framework for configuring authentication, most commonly the login component of Linux systems, but used in other components and operating systems.

learn more… | top users | synonyms

0
votes
1answer
1k views

How does changes in /etc/pam.d/common-session-noninteractive affect fail2ban and possibly other programs/services?

Fail2Ban on Ubuntu 10.04 Configuration files /etc/fail2ban/jail.local [DEFAULT] ignoreip = 127.0.0.1 bantime = 10 # made for test purposes maxretry = 3 backend = polling destemail = ...
3
votes
1answer
108 views

What does this plugable authentication module (PAM) “code” mean?

I am reading a configuration file for Linux PAM and am wondering what it means: auth [success=2 default=ignore] pam_krb5.so minimum_uid=1000 I understand that "auth" means this rule is ...
0
votes
1answer
960 views

Kerberos pre-authentication failed on nfs mount

I have the following nfs export: /home/users 192.168.1.0/24(rw,sec=krb5p,no_subtree_check,nohide,async,anonuid=65534,anongid=65534) When trying to mount that on a client I get: client:/home # ...
0
votes
1answer
357 views

Dell OMSA Authentication Fail on Ubuntu

I am trying to log into an install of Dell OMSA 5 on a Dell PowerEdge 2850 running Ubuntu 8.04 LTS x64. OMSA is 32bit and is trying to load the 64bit pam modules for authentication. Whatever ...
0
votes
1answer
938 views

Account lockout setting in Centos 6

I'm trying to implement an account lockout after 3 fail sign-on attempt. Root is exempted. Here's what I have in my /etc/pam.d/system-auth file so far auth required pam_tally2.so deny=3 ...
4
votes
2answers
1k views

vsftpd - PAM - MySQL and pam_mkhomedir to create directories

I've been successfully using vsftpd with virtual users connecting with PAM to my mysql DB. Now I'd like to automate creation of user directories with successful vsftpd connection. Here is ...
1
vote
0answers
65 views

Set pam_unix password without knowing current password, having authenticated with pam_winbind

Right, so I have winbind authentication set up for login. However, I think there may still be some situations in which it would be useful for the user to be able to set their unix password (in the ...
0
votes
1answer
171 views

Lag between PAM password acceptance and session open on CentOS5

I have a very interesting situation. I have a server running CentOS5.5, and whenever I try to ssh in using any external interface, there is a 4+ second delay, consistently. There is no such delay ...
0
votes
1answer
403 views

restarting authconfig changes order of my /etc/nsswitch.conf

Here is my nsswitch.conf: passwd: files ldap sss shadow: files ldap sss group: files sss When I restart authconfig, it removes ldap from passwd, shadow, and group. Here's my ...
0
votes
2answers
39 views

changing /etc/pam.d location

is there a way to change location of /etc/pam.d directory, or is it hardcoded into PAM? can't it be changed with some environment variable for specific client programs? for example: ...
0
votes
1answer
1k views

getent and ldapsearch results are inconsistent concerning the loginShell

I have a test that creates a user in LDAP with /bin/bash and I then modify the ldap attributes to /bin/noshell but the results from getent and ldapsearch are inconsistent for the shell. This user does ...
1
vote
1answer
725 views

Restricting LDAP users from authenticating without a valid shell

What I'm trying to accomplish is if I changed the user's attributes in LDAP to have no shell; for example: /etc/noshell, I do not want the user to ssh successfully. I have changed the attribute of one ...
0
votes
2answers
187 views

Requiring two-factor ssh authentication only from certain clients

I am about to make two-factor authentication mandatory for ssh logins using libpam_google_authenticator. I'd like to be able to waive this requirement when users log in from certain IP addresses. ...
1
vote
1answer
2k views

Linux PAM pam_succeed_if.so

I've specified an AD security group in PAM to restrict which domain users can login. I've also restricted sessions for AD users to this group. This prevents a logged in user from doing an "su -" to ...
0
votes
2answers
1k views

sshd[4344]: error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument?

OpenSSH_5.8p1, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 selinux-policy-2.4.6-338.el5 pam-0.99.6.2-12.el5 SELinux is running in permissive mode: # sestatus SELinux status: enabled ...
0
votes
1answer
71 views

Can I setup a Samba master password?

I want to be able to connect to a Samba share as a specific user but I don't know his password, and I don't want to change it. I did this on Dovecot by setting up a master password, can I do something ...
0
votes
2answers
252 views

Can't get pam_time.so to work with http

The /etc/security/time.conf man page contains this example: All users except for root are denied access to console-login at all times: login ; tty* & !ttyp* ; !root ; !Al0000-2400 For this ...
0
votes
1answer
276 views

Call Pam module before public key authentication on SSH

I am currently writing a pam module which does some checks if the key stored in authorized_keys is still valid. However I cant find a possiblity to run the module before the public key authentication ...
3
votes
0answers
2k views

Linux samba server: cifs_mount failed w/return code = -12

Server: RHEL 5.9 / smbd 3.0.33 - Clients: various, though all were using current mount.cifs (5.2) I already solved this problem, but it was such a nightmare to hunt down these error codes I felt like ...
1
vote
1answer
150 views

When changing passwords, how to let one PAM module check for old passwords and another to save new ones?

Our server is currently using the blowfish cipher to store passwords and it uses pam_unix2. We'd like to gradually switch to SHA. The idea is that all newly changed passwords would be hashed with SHA. ...
2
votes
1answer
82 views

configuring pam with flat files backend

I would like to configure pam module to use flat files for authentication. Basically I need same thing like pam_unix just with possibility to use different files (other than /etc/passwd and ...
0
votes
0answers
415 views

Why would Dovecot POP3 and IMAP Authentication from external IP address stop working?

Over a year ago I setup a Dovecot 1.2.9 POP3/IMAP server (which works alongside a Postfix SMTP server) with PAM authentication. This has been operating (I believe) without incident until recently ...
0
votes
2answers
381 views

validate only one user with pam ldap and nslcd

I want only user "theuser" to login to this host. I have tried the following in nslcd.conf: pam_authz_search (&(objectClass=posixAccount)(IsActive=TRUE)(uid=theuser)) but all can login. If ...
1
vote
1answer
1k views

Postfix smtpd won't talk to saslauthd

I have an saslauthd setup to authenticate against PAM. It seems to do its stuff: root@sasltest:~# testsaslauthd -u quest -p #### -s smtp 0: OK "Success." I have libsasl 2.1.23, postfix 2.7.1. I ...
1
vote
1answer
352 views

Ubuntu 12.10 - Can't find my logs

Up until few days ago, my Ubuntu 10.04 worked like a clock. Then I switched to Ubuntu 12.10 and things don't work the same way with this setup. First, the new system wasn't logging any mail activity, ...
3
votes
1answer
65 views

sudo failing even though ownership and modes set correctly

I am getting the dreaded sudo: must be setuid root error even though the executable in /usr/bin/sudo has ownership root:root and mode 4755 (-rwsr-xr-x). /etc/sudoers is mode 440. My user is in sudoers ...
2
votes
0answers
171 views

pam_mysql / vsftpd error 'AUTHENTICATION FALURE (FIRST_PASS)'

I setup vsftpd and mysql auth via pam on Debian Squeeze. Config: auth required pam_mysql.so user=server passwd=x host=localhost db=server table=ftp usercolumn=username passwdcolumn=password ...
1
vote
4answers
335 views

PAM LDAP authentication restriction

I have integrated PAM with LDAP authentication. Q- how to restrict login for some users to some Linux servers. For example- we have integrated 100 Linux servers in the Org with PAM LDAP auth and we ...
1
vote
1answer
265 views

MariaDB + PAM: Is Remote Auth Secure?

I have a MariaDB instance which is using PAM to auth against Active Directory. Is remote authentication with this service secure? I ran a Wireshark trace during the auth process, and passwords are not ...
2
votes
1answer
625 views

edit crontab for apache

I am transfering crontabs from an old server (centos 5.5) to a a new (centos 6.0) and there is a problem with (the most important) user apache. On the new server I am getting the following: ...
4
votes
1answer
1k views

Can I use DenyHosts for a SMTP service

I would like to block some hosts that are brute forcing my SMTP server. I'm currently using DenyHosts for SSHD and was wondering if I can add the SMTP service too. It could be possible based on this ...
2
votes
1answer
387 views

Authenticate Git virtual users via PAM

Can Git authenticate virtual users via PAM? In particular, would Git require some additional utility, such as gitolite or gitosis?
4
votes
4answers
2k views

How to increase max FD limit for a daemon process running under a headless user?

To increase the FD limit for a daemon process running under a headless user on a Ubuntu Linux machine we did following changes in /etc/security/limits.conf soft nofile 10000 hard nofile 10000 We ...
3
votes
2answers
1k views

Ubuntu 12.04 updates broke VSFTP

I am running Ubuntu 12.04 LTS. I did some minor updates using apt. After rebooting vsftp stopped accepting connections system user logins. In the auth log I am getting the following errors Dec 22 ...
2
votes
1answer
1k views

pam_tally2 or pam_faillock account lockout with ssh

I'm running RHEL 6.2. Most users will be using SSH to login using passwords. Some might have keys. All accounts are local. I need to lock users out after N failed password logins. The examples in ...
0
votes
2answers
630 views

Whitelist IP from google-authenticator in sshd pam

My Ubuntu 12.04 server uses the google-authenticator pam module to provide two step authentication for ssh. I need to make it so that a certain IP does not need to type the verification code. The ...
3
votes
4answers
3k views

How to grant su access without password to one user only in wheel group (FreeBSD)?

I know how to enable su without a password for all wheel group users by adding the appropriate configuration line in /etc/pam.d/su. I do not want to enable this for all wheel users but only one ...
2
votes
1answer
181 views

Customize PAM messages

I would like to customize my password expiration warnings. I figured PAM reads them from somewhere, but can't find from where. The question is relevant for both Ubuntu/Debian and Fedora/RHEL/CentOS. ...
0
votes
1answer
109 views

How to merge .rpmnew files in Pluggable Authentication Modules (PAM)?

A few .rpmnew files are being created after performing an upgrade of the Fedora OS. The normal procedure for merging .rpmnew files into the original ones is to compare the differences, make the ...
1
vote
1answer
237 views

MySQL Password Authentication with Proxy Users and Group Mapping

I'm actually using MariaDB here, but I'm working under the pretext that MariaDB is a "drop in replacement" for MySQL. I won't be surprised if this winds up being a cross platform difference/issue, but ...
2
votes
3answers
4k views

pam_ldap.so before pam_unix.so? Is it ever possible?

we have a couple of servers with PAM+LDAP. The configuration is standard (see http://arthurdejong.org/nss-pam-ldapd/setup or http://wiki.debian.org/LDAP/PAM). For example, /etc/pam.d/common-auth ...
2
votes
1answer
2k views

How do I disable password complexity in pam

I found tons of articles how to enable password complexity, can someone guide me to how to disable it? (oracle linux) This is my system-auth #%PAM-1.0 # This file is auto-generated. # User changes ...
0
votes
1answer
1k views

Authenticate by libpam-mysql and libnss-mysql (CentOS)

I'm trying to get MySQL to function as a backend for authenticating users on CentOS 6.3. So far I have successfully installed and configured libnss-mysql. I can test this by doing: # groups testuser ...
2
votes
2answers
936 views

Linux ldap authentication, pam_filter ignored

I've set up linux client authentication via ldap, it works. I want to control user's access to several services by adding or removing different OUs for accounts. E.g., if user is allowed to login ...
6
votes
2answers
11k views

Account Lockout with pam_tally2 in RHEL6

I am using pam_tally2 to lockout accounts after 3 failed logins per policy, however, the connecting user does not receive the error indicating pam_tally2's action. (Via SSH.) I expect to see on the ...
1
vote
1answer
337 views

ssh login fails for user with empty password [closed]

How do you enable ssh login on OS X 10.8 (Mountain Lion) for a user with an empty password? I've seen others asking this question, and like me it's for the same reason: a parent who can't deal with ...
3
votes
1answer
145 views

Can I use both the RSA 2-Factor PAM and an Active Directory PAM at the same time?

Let's use the product formerly known as Likewise as an example. I can very easily install this on a Linux machine and join it to an Active Directory domain. I can also use an RSA PAM module so that ...
0
votes
1answer
4k views

How do you configure /etc/pam.d/system-auth-ac on CentOS 6 using authconfig?

I'm trying to replace the cracklib module with passwdqc. Every time I do an authconfig --update (or --updateall), the changes I make on the system-auth-ac file goes away. The authconfig command line ...
3
votes
1answer
188 views

Locking user account on RHEL using PAM LDAP

I have a bit of an edge case here. My institution has a RHEL server where students can log in and do their work. Accounts are held in LDAP and the server uses PAM and LDAP to authenticate. At the end ...
1
vote
1answer
451 views

Immediate logout after login with PAM, Kerberos, and LDAP

I've set up remote login on a computer using Kerberos and LDAP. I've also configured NFS to mount onto /home so that the user's home directory is the same wherever they login. Kerberos authentication ...